Extracting prog: 1h7m42.034943737s Minimizing prog: 16m35.282001559s Simplifying prog options: 0s Extracting C: 37.840305008s Simplifying C: 10m36.936104314s extracting reproducer from 44 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-mkdirat-mount-openat-openat-write-syz_usb_connect$hid detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 44 programs with base timeout 30s testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 12, 14, 2, 7, 10, 10, 19, 27, 1, 2, 3, 3, 3, 8, 11, 7, 7, 4, 18, 8, 4, 13, 13, 17, 7, 13, 18, 18, 5, 2, 27, 9, 11, 6, 24, 4, 7, 12, 13, 7, 10, 17, 18] detailed listing: executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x50) sendmsg$nl_generic(r0, 0x0, 0x44080) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, 0x0) ftruncate(0xffffffffffffffff, 0x8008976) syz_usb_connect(0x2, 0x0, 0x0, 0x0) syz_usb_connect$midi(0x1, 0x0, 0x0, &(0x7f0000000440)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x200, 0x9, 0x2, 0xa, 0xff, 0x5}, 0xb, &(0x7f00000004c0)={0x5, 0xf, 0xb, 0x2, [@generic={0x3, 0x10, 0x4}, @ptm_cap={0x3}]}, 0x1, [{0x2, &(0x7f0000000500)=@string={0x2}}]}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0xe, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)={@map=r4, r5, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r4}, &(0x7f00000007c0), &(0x7f0000000800)=r3}, 0x20) sendmsg$inet(r2, &(0x7f0000000840)={0x0, 0x6000, &(0x7f0000000880)=[{&(0x7f00000008c0)='U', 0xa00120}], 0x1}, 0x3) executing program 3: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 3: socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_open_dev$tty1(0xc, 0x4, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/fib_triestat\x00') lseek(r3, 0x2000, 0x1) executing program 3: syz_mount_image$exfat(&(0x7f0000000400), &(0x7f0000000440)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10000, &(0x7f00000028c0)=ANY=[@ANYBLOB='time_offset=0x0000000000000000,discard,namecase=1,dmask=00000000000000000000177,errors=continue,errors=remount-ro,iocharset=cp857,fmask=00000000000000000000075,namecase=1,uid=', @ANYRESHEX=0xee01, @ANYBLOB="00050000000000000000d0948ce90800684bb58dd5679ddda3ece25a51743067f74f3ceacc7c6dce58aa904fd44c5979ccd05d29a70fcb6642fefe52d63ad8a7a8c88c32d40567f2b7872e436e677d0876391a1da8255b8f89dab8"], 0x1, 0x1550, &(0x7f0000000f80)="$eJzs3AuYjVX7MPD7Xms9Y0jaTXIY1lr3w04OiyTJIUkOSVJJkpwSkiZ5JSEx5JQ0JCE5DMlhCMlhYtI4n8+HhCRpkiQkp2R918R8Km//3v97yPe97t917ctas/a9nnvt27P3s9feM992GlyjYc2q9YkI/iV4/p9EAIgFgP4AcA0ABABQNq5sXOZ4domJ/9pB2L/XwymXOwN2OXH9r2xc/ysb1//KxvW/snH9r2xc/ysb1//KxvVn7Eq2cWr+a/l25d54//+/gvrnwvj1/79IRsnRX64ueX1ngJh/NITr//8//Bdiuf7/tYJ/5E5c/ysb1/9KFXu5E2D/D+Dz/0qQ7Q9HuP5XNq4/Y1eyX+8Fx8J/ap85+4WjXf797t/fIPKf/AzE9/gf1521dXM5188YY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjP0FTvmLFABktf/g7vgXp8cYY4wxxhhjjLF/A5/tcmfAGGOMMcYYY4yx/zwEARIUBBAD2SAWskMOEAAxWePXQhxcB7nhesgDeSEf5Id4KAAFQYMBCwQhFILCEIUboAjcCEWhGBSHEuCgJJSCm6A03Axl4BYoC7dCObgNykMFqAiV4HaoDHdAFbgTqsJdUA2qQw2oCXdDLbgHasO9UAfug7pwPzwAD0I9eAjqw8PQAB6BhvAoNILHoDE0gabQDJr/Pt5n+wfiX4Ru8BJ0hx6QCD2hF7wMvaEP9IV+0B9egQHwKgyE1yAJBsFgeB2GwBswFN6EYTAcRsBbMBLehlEwGsbAWEiGcTAe3oEJ8C5MhEkwGaZACkyFafAeTIcZMBPeh1nwAcyGOTAX5kEqfAjzYQGkwUewED6GdFgEi2EJLIVlsBxWwEpYBathDayFdbAeNsBG2ASbYQtshW2wHT6BHfAp7IRdsBs+gz3w+W/js/9Z/MnfxXdGQECBAhUqjMEYjMVYzIE5MCfmxFyYCyMYwTiMw9yYG/NgHsyH+TAe47EgFkSDBgkJC2EhjGIUi2ARLIpFsTgWR4cOS2EpLI03Yxksg2WxLJbDclgeK2AFrISVsDJWxipYBatiVayG1bAG1sC78W7sibWxNtbBOlgX62ZtT2F9rI8NsAE2xIbYCBthY2yMTbEpNsfm2AJbYEtsia2xNbbBNtgW22ICJmA7bIftsT12wA7YETtiJ+yEnbELdsl4MRvgS/gS9sBqoif2wl7YG5Oy9cV+2A9fwQH4Kr6Kr2ESDsLB+Dq+jm/gUDyBw84NxxE4AiuLt3EUjkYSYzEZk3E8jscJOAEn4iSchFMwBafiNJyG03EGzsD3cRZ+gB/gHJyD8zAVU3E+LsA0TMOFeBLTcREuxiW4FJfhUlyBK3EFrsY1uBrX4TrcgBtwE27CLbgFt+E2/AQVAH6Ku3AXJuEe3IN7cS/uw324H/djBmbgATyAB/EgHsJDeBgP4xE8isfwKB7H43gCT+IpPIVn8Ayexefjv27wSbFVSSAyKaFEjIgRsSJW5BA5RE6RU+QSuURERESciBO5RW6RR+QR+UQ+ES/iRUFRUBhhBIkw85lCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGrKCduE+VFBdHKVRKVRGXR2lURd4qqoqqoJqqLGqKmqClqiVqitqgt6og6oq6oKx4QD4p6oif2xYdFZmUaikHYSAzGxqKJkBeeoVqIodhStBKtxZNiOA7DtqKFSxDPiHZiFLYXfxOj8TnRUYzFTuIF0Vl0EV3Fi6KbaOm6ix5iIvYUvcQU7C36iL6in5iO1cX7OCt7DfGaSBKDxGDxupiHb4ih4ioxTAwXI8RbYqR4W4wSo8UYMVYki3FivHhHTBDviolikpgspogUMVVME++J6WKGmCneF7PEB2K2mCPminkiVXwo5osFIk18JBaKj0W6WCQWiyViqVgmlosVYqVYJVaLNWKtWCfWiw1io9gkNostYqvYJraLT8QO8anYKXaJ3eIzsUd8LvaKL8Q+8aXYL74SGeJrcUB8Iw6Kb8Uh8Z04LL4XR8RRcUz8II6LH8UJcVKcEqfFGfGTOCt+FueEF5B4/jFUMpAxMpuMldllDnmVzCmDrOd/GSevk7nl9TKPzCvzyfwyXhaQBaWWRlpJMpSFZGEZlTfIIvJGWVQWk8VlCelkSVlK3iRLy5tlGXmLLCtvleXkbbK8rCArykrydllZ3iEhcv4Y1WR1WUPWlHfLRLhH1pb3yjryPllX3i8fkA/KevIhWV8+LBvIR2RD+ahsJB+TjWUT2VQ2k83l47KFfEK2lK1ka/mkbCOfkm3l0zJBPiPbSX/hv8hzsqN8XnaSL8jOsovsKn+W56SX3WUPCT1B9pIvy96yj+wr+8n+8hU5QL4qB8rXZJIcJAfL1+UQ+YYcKt+Uw+RwOUK+JUfKt+UoOVqOkWNlshwnx8t35AT5rpwoJ8nJcopMkVNl3wszzZTyT+Pf+TvxA385+ga5UW6Sm+UWuVVuk9vlJ3KH3CF3yp1yt9wt98g9cq/cK/fJfXK/3C8zZIY8IA/Ig/KgPCQPycPysDwij8rT8gd5XP4oT8iT8qQ8Lc/IM/LshccAFCqhpFIqUDEqm4pV2VUOdZXKqa5WudQ1KqKuVXHqOpVbXa/yqLwqn8qv4lUBVVBpZZRVpEJVSBVWUXVD1ncDVXFVQjlVUpVSN/1v4lURdaMqqor9Jj4rv8Q/yK+5aq5aqBaqpWqpWqvWqo1qo9qqtipBJah2qp1qr9qrDqqD6qg6qk6qk+qsOquuqqvqprqp7qq7SlSJqpd6WfVWfVRf1U/1V6+IzDUMVANVkkpSg9VgNUQNUUPVUDVMDVMj1Ag1Uo1Uo9QoNUaNUckqWY1X49UENUFNVBPVZDVZpagUNU1NU9PVdDVTzVSzYrMembkqVaWq+Wq+SlNpaqFaqNLVIrVILVFL1DK1TK1QK9QqtUqtUWvUOrVOpauNaqParDarrWqr2q62qx1qh9qpdqrdarfao/aovWqv2qf2qf1qv8pQGeqAOqAOqoPqkDqkDqvD6og6oo6pY+q4Oq5OqBPqlDqlzqgz6qw6q86pc5mXfYEIRKACFcQEMUFsEBvkCHIEOYOcQa4gVxAJIkFcEBfkDq4P8gR5g3xB/iA+KBAUDHRgAhuIC0uLBjcERYIbg6JBsaB4UCJwQcmgVHBTUDq4OSgT3BKUDW4NygW3BeWDCkHFoFJwe1A5uCOoEtwZVA3uCqoF1YMaQc3g7qBWcE9QO7g3qBPcF9QN7g8eCB4M6gUPBfWDh4MGwSNBw+DRoFHwWNA4aBI0DZoFzf+t83t/Iu8TrrvuoRN1T91Lv6x76z66r+6n++tX9AD9qh6oX9NJepAerF/XQ/Qbeqh+Uw/Tw/UI/ZYeqd/Wo/RoPUaP1cl6nB6v39ET9Lt6op6kJ+spOkVP1dP0e3q6nqFn6vf1LP2Bnq3n6Ll6nk7VH+r5eoFO0x/phfpjna4X6cV6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7foTvUN/qnfqXXq3/kzv0Z/rvfoLvU9/qffrr3SG/lof0N/og/pbfUh/pw/r7/URfVSX0T/o4/pHfUKf1Kf0aX1G/6TP6p/1Oe0zL+4zX96NMsrEmBgTa2JNDpPD5DQ5TS6Ty0RMxMSZOJPb5DZ5TB6Tz+Qz8SbeFDQFTSYyZAqZQiZqoqaIKWKKmqKmuClunHGmlCllSpvSpowpY8qasqacKWfKm/Kmoqlobje3mzvMHeZOc6e5y9xlqpvqpqapaWqZWqa2qW3qmDqmrgIA84CpZ+qZ+qa+aWAamIamoWlkGpnGprFpapqa5qa5aWFamJampWltWps2po1pa9qaBJNg2pl2pr1pbzqYDqaj6Wg6mU6ms+lsupquppvpZrqb7ibRJJpeppfpbXqbvqav6W/6mwFmgBloBpokk2QGm8FmiBlihpqhZpgZbkZkg2xg3jajzGgzxow1ySbZjDfjzQQzwUw0E81kM9mkmBQzzUwz0810M9PMNLPMLDPbzDZzzVyTalLNfDPfpJm0zNPJpJt0s9gsNkvNUrPcLDcrzUqz2qw2a2GtWW/Wm41mo9lsNputZqvZbrabHWaH2Wl2mt1mt9lj9pi9Zq/ZZ/aZ/Wa/yTAZ5oA5YA6ag+aQOWQOm8PmiDlijplj5rg5bk6YE+aUOWXOmLwXXi+9ibXZbQ57lc1pr7a57DX29/18Nr+NtwVsQattHpv3N31jrS1qi9nitoR1tqQtZW+6pF/eVrAVbSV7u61s77BVLunXsvfY2vZeW8feZ2vau3/Tr2vvtw/YR209RADbxDawzWxD+6htZB+zjW0T29Q2s23sU7atfdom2GdsO/vsJf35doFdaVfZ1XaN3Wl32VP2tD1ov7Vn7E+2u+1h+9tX7AD7qh1oX7NJdtAl/RH2LTvSvm1H2dF2jB17SX+ynWJT7FQ7zb5np9sZl/RT7Yd2lk2zs+0cO9fO+6WfmVOa/cgutB/bdBvAYrvELrXL7HK74v/musSus+vtBrvDfmo32y12q91mt2ddCNtddrf9zO6xn9sD9hu7z35p99tDNsN+/Us/c32H7Hf2sP3eHrFH7TH7gz1uf1RZ0Zlr/8H+bM9Zb4GQgCQpCiiGslEsZaccdBXlpKspF11DEbqW4ug6yk3XUx7KS/koP8VTASpImgxZIgqpEBWmKN1AWekVpxLkqCSVopuoNN1MZegWKku3Ujm6jcpTBapIleh2qkx3UBW6k6rSXVSNqlMNqkl3Uy26h2rTvVSH7qO6dD89QA9SPXqI6tPD1IAeoYb0KDWix6gxNaGm1Iya0+PUgp6gltSKWtOT1Iaeorb0NCXQM9SOnqX29DfqQM9RR3qeOtEL1Jm6UFd6kbrRS9SdelAi9aRe9DL1pj7Ul/pRf3qFBtCrNJBeoyQaRIPpdRpCb9BQepOG0XAaQW/RSHqbRtFoGkNjKZnG0Xh6hybQuzSRJtFkmkIpNJWm0Xs0nWbQTHqfZtEHNJvm0FyaR6n0Ic2nBZRGH9FC+pjSaREtpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF2+oR20Ke0k3bRbvqM9tDntJe+oH30Je2nryiDvqYD9A0dpG/pEH3ne9D3dISO0jH6gY7Tj3SCTtIpOk1n6Cc6Sz/TOfIEIYYilKEKgzAmzBbGhtnDHOFVYc7w6jBXeE0YCa8N48Lrwtzh9WGeMG+YL8wfxocFwoKhDk1oQwrDsFBYOIyGN4RFwhvDomGxsHhYInRhybBUeFNYOrw5LBPeEpYNbw3LhbeF5cMK4aP3VQpvDyuHd4RVwjvDquFdYbWwelgjrBneHdYK7wlrh/eGdcL7wjLh/eED4YNhvfChsH74cNggfCRsGD4aNgofCxuHTcKmYbOwefh42CJ8ImwZtgpbh1eFbcKnwrbh02FC+EzYLnz2l/H7F2SNP3nJeGLYM+wVvhy+HHp/r5wbnRdNjX4YnR9dEE2LfhRdmHnORBdFF0eXRJdGl0WXR1dEV0ZXRVdH10TXRtdF10c3RL2vmQ0cOuGkUy5wMS6bi3XZXQ53lcvprna53DUu4q51ce46l9td7/K4vC6fy+/iXQFX0GlnnHXkQlfIFXZRd4Mr4m50RV0xV9yVcM6VdKVcM9fcNXct3BOupWvlWrsn3ZPuKfeUe9o97Z5x7dyzrr37m+vgnnMd3fPuefeC6+y6uK7uRdfNjct1/pxMdL1cL9fb9XZ9XV/X3/V3A9wAN9ANdEkuyQ12g90QN8QNdUPdMDfMjXAj3Eg30o1yo9wYN8Ylu2Q33o13E9wEN9FNdJPdZJfiUtw0N81Nd9Nd5RnnjzLbzXZz3VyX6lLdfJd5zZjmFrqFLt2lu8VusVvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+F2uJ3+mvOTuj1ur9vr9rl9br/7ymW4r90B94076L51h9x37rD73h1xR90x94M77n50J9xJd8qddmfcT+6s+9mdc94lR8ZFxkfeiUyIvBuZGJkUmRyZEkmJTI1Mi7wXmR6ZEZkZeT8yK/JBZHZkTmRuZF4kNfJhZH5kQSQt8lFkYeTjSHpkUWRxZElkaWRZxPsCm0NfyBf2UX+DL+Jv9EV9MV/cl/DOl/Sl/E2+9Pm8072/1Zfzt/nyvoKv6B/zjX0T39Q38839476Ff8K39K18a/+kb+Of8m390z7BP+Pb+Wd9e/8338E/5zv6530n/4Lv7Lv4rv5F382/5Lv7Hj7R9/S9/Mu+t+/j+/p+vr9/xQ/wr/qB/jWf5Af5wf51P8S/4Yf6N/0wP9yPiHnLj8x6iwxjfbIf58f7d/wE/66f6Cf5yX6KT/FT/TT/np/uZ/iZ/n0/y3/gZ/s5fq6f51P9h36+X+DT/Ed+of/Yp/tFWZvGfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX67/8Tv8J/6nX6X3+0/83v8536v/8Lv81/6/f4rn+G/9gf8N/6g/9Yf8t/5w/57f8Qf9cf8D/64/9Gf8Cf9KX/an/E/+bP+Z3/uj39njTHGGGOM/cq4i03x25Hz2/k9/06M+NWdewHA1VvyZ/x6PPOKcm2e8+0+Iv6X3e9nenR6OOtWrVpi4oWPnSBdQlB4DkDWJ0GZfvnqwYX+ImgNT0ECtILSfzf/PqLLGfqT+aO3AuT4VUxmQln9i/N/AYCJl6y3j3j8yRHzy4Wn4v6H+ecAFC18MSY7XOwvgta/7K+0gjJ/kH/eFn+Sf/YvkwFa/iomJ1zsX8y/FDwBz0LCb+7JGGOMMcYYY4yd10dU7JD1/jPrG59/7/15vLoYkw0u9v/s/TljjDHGGGOMMcYuv+e6dH368YSEVh3+940q/1TUP9xoBP+pmbnx20YuAGjV4TnvAbKGFAD8izMDZDbkX7mcTX/JsZIunDq/H1p62geQ9ROE879ZfdmL+083Lu/zEmOMMcYYY+zf7+JF/29/ri5XQowxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG2BXor/hzYpd7jYwxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxtjl9n8CAAD//2Lv6gk=") mount$bind(&(0x7f0000002a00)='./file0\x00', &(0x7f0000002a40)='./file0\x00', 0x0, 0x101091, 0x0) executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', 0x0, 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x14a0, &(0x7f0000000580)=ANY=[], 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 3: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r1, &(0x7f0000000580)={&(0x7f00000005c0)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000fdff7f006110a40000000000c60000000000000095000000000000009f33ef60916e6e713f1e6b0b725ad99b817fd98cd824498949714e32f21dcc4ae5437aca55f21f3ca9e822d182054d54d53cd2b6da714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed00000000000000000000000000000000000000006c63b40e0c00000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f79829c90bd2114252581567acae715cbe1b57d5cda432c5b9443999f7d24195405f2e76ba88454cc9227069ccb7b37b41215c000000003be991e5e897284cdd6043058cec00000000000000"], &(0x7f0000000880)='GPL\x00', 0x4, 0xfd90, &(0x7f00000008c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000009c0), 0x366, 0x10, &(0x7f0000000a00), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000a80)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{r3}, &(0x7f0000000b00), &(0x7f0000000b40)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000c00)=""/182, 0xb6}], 0x1}, 0x100b6) close(r3) executing program 32: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r1, &(0x7f0000000580)={&(0x7f00000005c0)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000fdff7f006110a40000000000c60000000000000095000000000000009f33ef60916e6e713f1e6b0b725ad99b817fd98cd824498949714e32f21dcc4ae5437aca55f21f3ca9e822d182054d54d53cd2b6da714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed00000000000000000000000000000000000000006c63b40e0c00000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f79829c90bd2114252581567acae715cbe1b57d5cda432c5b9443999f7d24195405f2e76ba88454cc9227069ccb7b37b41215c000000003be991e5e897284cdd6043058cec00000000000000"], &(0x7f0000000880)='GPL\x00', 0x4, 0xfd90, &(0x7f00000008c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000009c0), 0x366, 0x10, &(0x7f0000000a00), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000a80)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{r3}, &(0x7f0000000b00), &(0x7f0000000b40)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000c00)=""/182, 0xb6}], 0x1}, 0x100b6) close(r3) executing program 1: openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x101000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES64], 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x10, 0x803, 0x0) syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x8942) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000611930000000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socket$netlink(0x10, 0x3, 0x4) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r2}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)}) executing program 1: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x1a0001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x20002, 0x80) ioctl(r5, 0x40104d04, &(0x7f0000000180)="9c81") sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./config\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') executing program 1: syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 1: r0 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x24, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0xffe0}, {0xb, 0x1}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x24008814}, 0x8090) executing program 1: r0 = syz_usb_connect(0x3, 0x50, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000405205105500000102000109023e00010100803209040000040806620007050102"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x39, &(0x7f0000000500)=""/57) executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x1, 0x42, 0x2, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r0}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x8000, r1, 0x0, 0xf2ffffffffffffff}, 0x38) executing program 33: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x1, 0x42, 0x2, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r0}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x8000, r1, 0x0, 0xf2ffffffffffffff}, 0x38) executing program 5: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), 0x0, 0x14a0, &(0x7f0000000580)=ANY=[], 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 6: syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ff"], 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000040)='1', 0x1) executing program 0: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 0: r0 = add_key$keyring(&(0x7f0000019a00), &(0x7f0000019a40)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000019a80), &(0x7f0000019ac0)={'syz', 0x3}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000019b00), &(0x7f0000019b40)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$KEYCTL_MOVE(0x1e, r1, r1, r0, 0x0) executing program 0: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='270', 0x3) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) setns(0xffffffffffffffff, 0x10000000) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r3}, [@snapshot={0x0, 0x1008, 0x0, 0x48, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '128'}}]}) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f00000002c0)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000340)={0x0, 0x20fb87, 0x800, 0xfffffffe, 0x32c}, 0x0, 0x1, &(0x7f0000000a00)={0x2e, 0x0, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) executing program 4: syz_mount_image$iso9660(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x208007, &(0x7f0000000180)=ANY=[], 0x3, 0x597, &(0x7f00000004c0)="$eJzs3c9v2+Ydx/EPXTt2NCAbtiEIAid9mmyAA7gqJTcOjJ446pHNViIFkmrtUxE0cmFE7opkAxZftlyyDdj+iF5333XYfdf9G8V6GnbTQFKy5ehX4jiRE7xfQsJH5Jd8vpQFffHY4kMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5fs11K44aQdjeNZP5tThqjq7WolQ0+u6cWkzpV3Kyf1pZ0bVi1bWfn2y+mv13S6vFs1WtZIsVHf3o6k8++dniwmD/KQm/EY+fHD283+12Hs07kTnZtmGQREHT27YmSCKzdVnSTj0x9aBhk70ktU3jx9ZLo9is+XdMZWtrw9jyXtQOt2teww5W3vuw6rqb5tNyy3pxEoUffVpO/J2g0QjC7Twm25zF3MveiJ8FqUmt1zRm/6Db2ZiVZBZUeZGg6qygqlutVirVamXz7tbde667OLLCPeHIdV2NRMz/TYv5OudPcODsFvr1Xw0FCtXWrszYh6+aYkVqjmy5JGmk/v/yIzu13+H6n1f5nlavnWy+rrz+3yye3ZxU/yfkOuWxJJ1hr+cflwbHeKwnOtJD3VdXXXX06CRm/Vx6uuCPbVmFCpQoUqCmvHyN6a8x2tKmNuXqS+2orkRGdQVqyCrRnhKlsvk7ylesZXlKFSmW0Zp83ZFRRb3lLW3IyKqsPUVqK9S2avLyo+zrIH/dN6bkeBxUmRL0xeCdV50S9FL1Pze8y7+o/6D+4yLpDer/896bRzYAAAAAAOB1cPLfvmfj/yXdkJYc1YOGdeedFgAAAAAAOEf5X/5Xs0X+zbgbchj/AwAAAADwrnHya+wcSSW9X7QGl0v1fwnQ+/G8cwQAAAAAAK8m//v/zWxRylrvy3l+/A8AAAAAAN52f5o0x/4/pV5/WsBl5x//URwvOU9bu79wDr1snXfYnyBwZJ7AtH7dudI/SL7YXOw/8+2q05/98ngSzO/7i/1Zc/0755CA/qIPipgPHhTLB4MtRS+letCwZT9qfFKR511ZSO1u+ttvDn6n/PT/HDavOD/sH3Q75a9+3X2Q5/I0O8rTw/4rNTKP4pRcfqMbRcyN8We8lF+I0e+35Cjr1x0+/4Vi94WX6POZbhUxt0rFsnT6/FeyPivlSWdfZLEs6ZXO/JluFzG3124XizFZVGdk0akOv/5nei1eIIuNaVksH3Q7G6+YBQDMy/70KpR773TdPcOn3EtV9+WzVvdnWiti1q7nH6yL18d8oruz6oo7pq6vHHe/OMii9/sJWfxt5B5Ik2ps1u9fj/ut5P1+l+3w3cSqmjSqjla+/W+vd/itrj5+cvThweH9rztfd76pVjc23Y9d925VS/lp9BfUHgDAGLPvsTMzwvm4P6q+PGFU/dPjrxSU9ZX0v17vgdbzqw3ybxyMPWop3+eH/GsI6zNGraWhO7yszxjVncRWXyJ24038KAAAeGNuzajDk+u/M7iLn7M+Y9xdGvpK4frw6PiSRkbHw7UcAAC8Hjb+3imlf3TiOGh9WdnaqnjpjjVx5H9m4qC2bU0Qpjb2d7xw25pWHKWRHzWyxudBzSYmabdaUZyaehSbVpQEu/md303/1u+JbXphGvhJq2G9xBo/ClPPT00tSHzTav+qESQ7Ns53TlrWD+qB76VBFJokase+LRuTWDsUGNRsmAb1IGuGphUHTS/eM59HjXbTmppN/DhopVFxwEFfQViP4mZ+2PK8X2wAAC6Ix0+OHt7vdjuPBg1n8fk1r9yY9zkCAIDTqNIAAAAAAAAAAAAAAAAAAAAAAFx853aR3zvVWH4dR/5CryPVy5Kmx/y7JA2v6fVetIuFi/CzONUYTDo9JebvYzZJ+sP8k3+7GuM+LUbmowbwFvt/AAAA///OdlQ+") syz_mount_image$exfat(0x0, &(0x7f0000006800)='./bus\x00', 0xe1c00, 0x0, 0x0, 0x0, &(0x7f0000006840)) executing program 2: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x1a0001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x20002, 0x80) ioctl(r5, 0x40104d04, &(0x7f0000000180)="9c81") sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') executing program 5: timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000480), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000005c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000640)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003440)=[{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000280)="0531c9ed62aeb42fde8c0a136359023956c6328bd79c9f717640bcc292f258", 0x1f}, {&(0x7f00000002c0)="e974e2f73c340e59826162c619679eb2d893b8e2adb5e8a53a", 0x19}, {&(0x7f0000001ac0)="e3b9b29036b43ae4e44d369be058f67468c169a41a21e9138ef649fbbb3bfe69b1a3a17491d7804854eb91d90a1e3b8319447572f30d8befc5ee8f1ade64351948f86fbc69dd3fae55168e70d7698bd65b682deeb1e3878c6d35a98be44d850a4723e0a0baf1ce943f28a636729346502e72b2c6bd286df11aebcc7ce224fe7ff34a899e5febafa0180120258dc9a9c3bfa3441f92a64b7be1e6acaf5842cdaa8a98dc71b24976464583fde6922ecef25a3a9847f0239eac44bd255eb89e6ac77ab9f5f549294f2e89cc", 0xca}, {&(0x7f0000001bc0)="694872d2b63b4fd2835faca2cf06bd09110ac031f6a59b1324efae0e226c2c16ec5a7238d30c02e5677b4f9626ee4b575553f3698c9633e7f1bfa8ca3d0cb3559c736e1e7a", 0x45}, {&(0x7f0000001c40)="edc1dd49360d850f534dfd63a888bbda5375154634507199fd061d11", 0x1c}, {&(0x7f0000001cc0)}], 0x6, 0x0, 0x0, 0x4880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)=""/4105, 0x1009}, {&(0x7f0000001a00)=""/176, 0xb0}], 0x2}, 0x4}], 0x1, 0x40002020, 0x0) executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYRESHEX], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$SNDCTL_TMR_TEMPO(0xffffffffffffffff, 0xc0045405, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'tunl0\x00'}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_setup(0xaae, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x400000, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, &(0x7f0000000180)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) openat$tun(0xffffffffffffff9c, 0x0, 0xa0800, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x20) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000780)='numa_maps\x00') read$FUSE(r3, &(0x7f0000000880)={0x2020}, 0x2020) executing program 5: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x6, @private0, 0xee}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/icmp6\x00') preadv(r1, &(0x7f0000000380)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1, 0xa3, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x14a0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 4: openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x4175, &(0x7f0000000100)={0x0, 0x136f, 0x10000, 0x3, 0x2d0}, 0x0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000280)="e2", 0xff0f) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 5: r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x41, 0x1ff) fcntl$setlease(r1, 0x400, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-mkdirat-mount-openat-openat-write-syz_usb_connect$hid detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 44 programs with base timeout 1m40s testing program (duration=1m51s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 12, 14, 2, 7, 10, 10, 19, 27, 1, 2, 3, 3, 3, 8, 11, 7, 7, 4, 18, 8, 4, 13, 13, 17, 7, 13, 18, 18, 5, 2, 27, 9, 11, 6, 24, 4, 7, 12, 13, 7, 10, 17, 18] detailed listing: executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x50) sendmsg$nl_generic(r0, 0x0, 0x44080) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, 0x0) ftruncate(0xffffffffffffffff, 0x8008976) syz_usb_connect(0x2, 0x0, 0x0, 0x0) syz_usb_connect$midi(0x1, 0x0, 0x0, &(0x7f0000000440)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x200, 0x9, 0x2, 0xa, 0xff, 0x5}, 0xb, &(0x7f00000004c0)={0x5, 0xf, 0xb, 0x2, [@generic={0x3, 0x10, 0x4}, @ptm_cap={0x3}]}, 0x1, [{0x2, &(0x7f0000000500)=@string={0x2}}]}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0xe, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)={@map=r4, r5, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r4}, &(0x7f00000007c0), &(0x7f0000000800)=r3}, 0x20) sendmsg$inet(r2, &(0x7f0000000840)={0x0, 0x6000, &(0x7f0000000880)=[{&(0x7f00000008c0)='U', 0xa00120}], 0x1}, 0x3) executing program 3: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 3: socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_open_dev$tty1(0xc, 0x4, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/fib_triestat\x00') lseek(r3, 0x2000, 0x1) executing program 3: syz_mount_image$exfat(&(0x7f0000000400), &(0x7f0000000440)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10000, &(0x7f00000028c0)=ANY=[@ANYBLOB='time_offset=0x0000000000000000,discard,namecase=1,dmask=00000000000000000000177,errors=continue,errors=remount-ro,iocharset=cp857,fmask=00000000000000000000075,namecase=1,uid=', @ANYRESHEX=0xee01, @ANYBLOB="00050000000000000000d0948ce90800684bb58dd5679ddda3ece25a51743067f74f3ceacc7c6dce58aa904fd44c5979ccd05d29a70fcb6642fefe52d63ad8a7a8c88c32d40567f2b7872e436e677d0876391a1da8255b8f89dab8"], 0x1, 0x1550, &(0x7f0000000f80)="$eJzs3AuYjVX7MPD7Xms9Y0jaTXIY1lr3w04OiyTJIUkOSVJJkpwSkiZ5JSEx5JQ0JCE5DMlhCMlhYtI4n8+HhCRpkiQkp2R918R8Km//3v97yPe97t917ctas/a9nnvt27P3s9feM992GlyjYc2q9YkI/iV4/p9EAIgFgP4AcA0ABABQNq5sXOZ4domJ/9pB2L/XwymXOwN2OXH9r2xc/ysb1//KxvW/snH9r2xc/ysb1//KxvVn7Eq2cWr+a/l25d54//+/gvrnwvj1/79IRsnRX64ueX1ngJh/NITr//8//Bdiuf7/tYJ/5E5c/ysb1/9KFXu5E2D/D+Dz/0qQ7Q9HuP5XNq4/Y1eyX+8Fx8J/ap85+4WjXf797t/fIPKf/AzE9/gf1521dXM5188YY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjP0FTvmLFABktf/g7vgXp8cYY4wxxhhjjLF/A5/tcmfAGGOMMcYYY4yx/zwEARIUBBAD2SAWskMOEAAxWePXQhxcB7nhesgDeSEf5Id4KAAFQYMBCwQhFILCEIUboAjcCEWhGBSHEuCgJJSCm6A03Axl4BYoC7dCObgNykMFqAiV4HaoDHdAFbgTqsJdUA2qQw2oCXdDLbgHasO9UAfug7pwPzwAD0I9eAjqw8PQAB6BhvAoNILHoDE0gabQDJr/Pt5n+wfiX4Ru8BJ0hx6QCD2hF7wMvaEP9IV+0B9egQHwKgyE1yAJBsFgeB2GwBswFN6EYTAcRsBbMBLehlEwGsbAWEiGcTAe3oEJ8C5MhEkwGaZACkyFafAeTIcZMBPeh1nwAcyGOTAX5kEqfAjzYQGkwUewED6GdFgEi2EJLIVlsBxWwEpYBathDayFdbAeNsBG2ASbYQtshW2wHT6BHfAp7IRdsBs+gz3w+W/js/9Z/MnfxXdGQECBAhUqjMEYjMVYzIE5MCfmxFyYCyMYwTiMw9yYG/NgHsyH+TAe47EgFkSDBgkJC2EhjGIUi2ARLIpFsTgWR4cOS2EpLI03Yxksg2WxLJbDclgeK2AFrISVsDJWxipYBatiVayG1bAG1sC78W7sibWxNtbBOlgX62ZtT2F9rI8NsAE2xIbYCBthY2yMTbEpNsfm2AJbYEtsia2xNbbBNtgW22ICJmA7bIftsT12wA7YETtiJ+yEnbELdsl4MRvgS/gS9sBqoif2wl7YG5Oy9cV+2A9fwQH4Kr6Kr2ESDsLB+Dq+jm/gUDyBw84NxxE4AiuLt3EUjkYSYzEZk3E8jscJOAEn4iSchFMwBafiNJyG03EGzsD3cRZ+gB/gHJyD8zAVU3E+LsA0TMOFeBLTcREuxiW4FJfhUlyBK3EFrsY1uBrX4TrcgBtwE27CLbgFt+E2/AQVAH6Ku3AXJuEe3IN7cS/uw324H/djBmbgATyAB/EgHsJDeBgP4xE8isfwKB7H43gCT+IpPIVn8Ayexefjv27wSbFVSSAyKaFEjIgRsSJW5BA5RE6RU+QSuURERESciBO5RW6RR+QR+UQ+ES/iRUFRUBhhBIkw85lCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGrKCduE+VFBdHKVRKVRGXR2lURd4qqoqqoJqqLGqKmqClqiVqitqgt6og6oq6oKx4QD4p6oif2xYdFZmUaikHYSAzGxqKJkBeeoVqIodhStBKtxZNiOA7DtqKFSxDPiHZiFLYXfxOj8TnRUYzFTuIF0Vl0EV3Fi6KbaOm6ix5iIvYUvcQU7C36iL6in5iO1cX7OCt7DfGaSBKDxGDxupiHb4ih4ioxTAwXI8RbYqR4W4wSo8UYMVYki3FivHhHTBDviolikpgspogUMVVME++J6WKGmCneF7PEB2K2mCPminkiVXwo5osFIk18JBaKj0W6WCQWiyViqVgmlosVYqVYJVaLNWKtWCfWiw1io9gkNostYqvYJraLT8QO8anYKXaJ3eIzsUd8LvaKL8Q+8aXYL74SGeJrcUB8Iw6Kb8Uh8Z04LL4XR8RRcUz8II6LH8UJcVKcEqfFGfGTOCt+FueEF5B4/jFUMpAxMpuMldllDnmVzCmDrOd/GSevk7nl9TKPzCvzyfwyXhaQBaWWRlpJMpSFZGEZlTfIIvJGWVQWk8VlCelkSVlK3iRLy5tlGXmLLCtvleXkbbK8rCArykrydllZ3iEhcv4Y1WR1WUPWlHfLRLhH1pb3yjryPllX3i8fkA/KevIhWV8+LBvIR2RD+ahsJB+TjWUT2VQ2k83l47KFfEK2lK1ka/mkbCOfkm3l0zJBPiPbSX/hv8hzsqN8XnaSL8jOsovsKn+W56SX3WUPCT1B9pIvy96yj+wr+8n+8hU5QL4qB8rXZJIcJAfL1+UQ+YYcKt+Uw+RwOUK+JUfKt+UoOVqOkWNlshwnx8t35AT5rpwoJ8nJcopMkVNl3wszzZTyT+Pf+TvxA385+ga5UW6Sm+UWuVVuk9vlJ3KH3CF3yp1yt9wt98g9cq/cK/fJfXK/3C8zZIY8IA/Ig/KgPCQPycPysDwij8rT8gd5XP4oT8iT8qQ8Lc/IM/LshccAFCqhpFIqUDEqm4pV2VUOdZXKqa5WudQ1KqKuVXHqOpVbXa/yqLwqn8qv4lUBVVBpZZRVpEJVSBVWUXVD1ncDVXFVQjlVUpVSN/1v4lURdaMqqor9Jj4rv8Q/yK+5aq5aqBaqpWqpWqvWqo1qo9qqtipBJah2qp1qr9qrDqqD6qg6qk6qk+qsOquuqqvqprqp7qq7SlSJqpd6WfVWfVRf1U/1V6+IzDUMVANVkkpSg9VgNUQNUUPVUDVMDVMj1Ag1Uo1Uo9QoNUaNUckqWY1X49UENUFNVBPVZDVZpagUNU1NU9PVdDVTzVSzYrMembkqVaWq+Wq+SlNpaqFaqNLVIrVILVFL1DK1TK1QK9QqtUqtUWvUOrVOpauNaqParDarrWqr2q62qx1qh9qpdqrdarfao/aovWqv2qf2qf1qv8pQGeqAOqAOqoPqkDqkDqvD6og6oo6pY+q4Oq5OqBPqlDqlzqgz6qw6q86pc5mXfYEIRKACFcQEMUFsEBvkCHIEOYOcQa4gVxAJIkFcEBfkDq4P8gR5g3xB/iA+KBAUDHRgAhuIC0uLBjcERYIbg6JBsaB4UCJwQcmgVHBTUDq4OSgT3BKUDW4NygW3BeWDCkHFoFJwe1A5uCOoEtwZVA3uCqoF1YMaQc3g7qBWcE9QO7g3qBPcF9QN7g8eCB4M6gUPBfWDh4MGwSNBw+DRoFHwWNA4aBI0DZoFzf+t83t/Iu8TrrvuoRN1T91Lv6x76z66r+6n++tX9AD9qh6oX9NJepAerF/XQ/Qbeqh+Uw/Tw/UI/ZYeqd/Wo/RoPUaP1cl6nB6v39ET9Lt6op6kJ+spOkVP1dP0e3q6nqFn6vf1LP2Bnq3n6Ll6nk7VH+r5eoFO0x/phfpjna4X6cV6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7foTvUN/qnfqXXq3/kzv0Z/rvfoLvU9/qffrr3SG/lof0N/og/pbfUh/pw/r7/URfVSX0T/o4/pHfUKf1Kf0aX1G/6TP6p/1Oe0zL+4zX96NMsrEmBgTa2JNDpPD5DQ5TS6Ty0RMxMSZOJPb5DZ5TB6Tz+Qz8SbeFDQFTSYyZAqZQiZqoqaIKWKKmqKmuClunHGmlCllSpvSpowpY8qasqacKWfKm/Kmoqlobje3mzvMHeZOc6e5y9xlqpvqpqapaWqZWqa2qW3qmDqmrgIA84CpZ+qZ+qa+aWAamIamoWlkGpnGprFpapqa5qa5aWFamJampWltWps2po1pa9qaBJNg2pl2pr1pbzqYDqaj6Wg6mU6ms+lsupquppvpZrqb7ibRJJpeppfpbXqbvqav6W/6mwFmgBloBpokk2QGm8FmiBlihpqhZpgZbkZkg2xg3jajzGgzxow1ySbZjDfjzQQzwUw0E81kM9mkmBQzzUwz0810M9PMNLPMLDPbzDZzzVyTalLNfDPfpJm0zNPJpJt0s9gsNkvNUrPcLDcrzUqz2qw2a2GtWW/Wm41mo9lsNputZqvZbrabHWaH2Wl2mt1mt9lj9pi9Zq/ZZ/aZ/Wa/yTAZ5oA5YA6ag+aQOWQOm8PmiDlijplj5rg5bk6YE+aUOWXOmLwXXi+9ibXZbQ57lc1pr7a57DX29/18Nr+NtwVsQattHpv3N31jrS1qi9nitoR1tqQtZW+6pF/eVrAVbSV7u61s77BVLunXsvfY2vZeW8feZ2vau3/Tr2vvtw/YR209RADbxDawzWxD+6htZB+zjW0T29Q2s23sU7atfdom2GdsO/vsJf35doFdaVfZ1XaN3Wl32VP2tD1ov7Vn7E+2u+1h+9tX7AD7qh1oX7NJdtAl/RH2LTvSvm1H2dF2jB17SX+ynWJT7FQ7zb5np9sZl/RT7Yd2lk2zs+0cO9fO+6WfmVOa/cgutB/bdBvAYrvELrXL7HK74v/musSus+vtBrvDfmo32y12q91mt2ddCNtddrf9zO6xn9sD9hu7z35p99tDNsN+/Us/c32H7Hf2sP3eHrFH7TH7gz1uf1RZ0Zlr/8H+bM9Zb4GQgCQpCiiGslEsZaccdBXlpKspF11DEbqW4ug6yk3XUx7KS/koP8VTASpImgxZIgqpEBWmKN1AWekVpxLkqCSVopuoNN1MZegWKku3Ujm6jcpTBapIleh2qkx3UBW6k6rSXVSNqlMNqkl3Uy26h2rTvVSH7qO6dD89QA9SPXqI6tPD1IAeoYb0KDWix6gxNaGm1Iya0+PUgp6gltSKWtOT1Iaeorb0NCXQM9SOnqX29DfqQM9RR3qeOtEL1Jm6UFd6kbrRS9SdelAi9aRe9DL1pj7Ul/pRf3qFBtCrNJBeoyQaRIPpdRpCb9BQepOG0XAaQW/RSHqbRtFoGkNjKZnG0Xh6hybQuzSRJtFkmkIpNJWm0Xs0nWbQTHqfZtEHNJvm0FyaR6n0Ic2nBZRGH9FC+pjSaREtpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF2+oR20Ke0k3bRbvqM9tDntJe+oH30Je2nryiDvqYD9A0dpG/pEH3ne9D3dISO0jH6gY7Tj3SCTtIpOk1n6Cc6Sz/TOfIEIYYilKEKgzAmzBbGhtnDHOFVYc7w6jBXeE0YCa8N48Lrwtzh9WGeMG+YL8wfxocFwoKhDk1oQwrDsFBYOIyGN4RFwhvDomGxsHhYInRhybBUeFNYOrw5LBPeEpYNbw3LhbeF5cMK4aP3VQpvDyuHd4RVwjvDquFdYbWwelgjrBneHdYK7wlrh/eGdcL7wjLh/eED4YNhvfChsH74cNggfCRsGD4aNgofCxuHTcKmYbOwefh42CJ8ImwZtgpbh1eFbcKnwrbh02FC+EzYLnz2l/H7F2SNP3nJeGLYM+wVvhy+HHp/r5wbnRdNjX4YnR9dEE2LfhRdmHnORBdFF0eXRJdGl0WXR1dEV0ZXRVdH10TXRtdF10c3RL2vmQ0cOuGkUy5wMS6bi3XZXQ53lcvprna53DUu4q51ce46l9td7/K4vC6fy+/iXQFX0GlnnHXkQlfIFXZRd4Mr4m50RV0xV9yVcM6VdKVcM9fcNXct3BOupWvlWrsn3ZPuKfeUe9o97Z5x7dyzrr37m+vgnnMd3fPuefeC6+y6uK7uRdfNjct1/pxMdL1cL9fb9XZ9XV/X3/V3A9wAN9ANdEkuyQ12g90QN8QNdUPdMDfMjXAj3Eg30o1yo9wYN8Ylu2Q33o13E9wEN9FNdJPdZJfiUtw0N81Nd9Nd5RnnjzLbzXZz3VyX6lLdfJd5zZjmFrqFLt2lu8VusVvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+F2uJ3+mvOTuj1ur9vr9rl9br/7ymW4r90B94076L51h9x37rD73h1xR90x94M77n50J9xJd8qddmfcT+6s+9mdc94lR8ZFxkfeiUyIvBuZGJkUmRyZEkmJTI1Mi7wXmR6ZEZkZeT8yK/JBZHZkTmRuZF4kNfJhZH5kQSQt8lFkYeTjSHpkUWRxZElkaWRZxPsCm0NfyBf2UX+DL+Jv9EV9MV/cl/DOl/Sl/E2+9Pm8072/1Zfzt/nyvoKv6B/zjX0T39Q38839476Ff8K39K18a/+kb+Of8m390z7BP+Pb+Wd9e/8338E/5zv6530n/4Lv7Lv4rv5F382/5Lv7Hj7R9/S9/Mu+t+/j+/p+vr9/xQ/wr/qB/jWf5Af5wf51P8S/4Yf6N/0wP9yPiHnLj8x6iwxjfbIf58f7d/wE/66f6Cf5yX6KT/FT/TT/np/uZ/iZ/n0/y3/gZ/s5fq6f51P9h36+X+DT/Ed+of/Yp/tFWZvGfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX67/8Tv8J/6nX6X3+0/83v8536v/8Lv81/6/f4rn+G/9gf8N/6g/9Yf8t/5w/57f8Qf9cf8D/64/9Gf8Cf9KX/an/E/+bP+Z3/uj39njTHGGGOM/cq4i03x25Hz2/k9/06M+NWdewHA1VvyZ/x6PPOKcm2e8+0+Iv6X3e9nenR6OOtWrVpi4oWPnSBdQlB4DkDWJ0GZfvnqwYX+ImgNT0ECtILSfzf/PqLLGfqT+aO3AuT4VUxmQln9i/N/AYCJl6y3j3j8yRHzy4Wn4v6H+ecAFC18MSY7XOwvgta/7K+0gjJ/kH/eFn+Sf/YvkwFa/iomJ1zsX8y/FDwBz0LCb+7JGGOMMcYYY4yd10dU7JD1/jPrG59/7/15vLoYkw0u9v/s/TljjDHGGGOMMcYuv+e6dH368YSEVh3+940q/1TUP9xoBP+pmbnx20YuAGjV4TnvAbKGFAD8izMDZDbkX7mcTX/JsZIunDq/H1p62geQ9ROE879ZfdmL+083Lu/zEmOMMcYYY+zf7+JF/29/ri5XQowxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG2BXor/hzYpd7jYwxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxtjl9n8CAAD//2Lv6gk=") mount$bind(&(0x7f0000002a00)='./file0\x00', &(0x7f0000002a40)='./file0\x00', 0x0, 0x101091, 0x0) executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', 0x0, 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x14a0, &(0x7f0000000580)=ANY=[], 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 3: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r1, &(0x7f0000000580)={&(0x7f00000005c0)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000fdff7f006110a40000000000c60000000000000095000000000000009f33ef60916e6e713f1e6b0b725ad99b817fd98cd824498949714e32f21dcc4ae5437aca55f21f3ca9e822d182054d54d53cd2b6da714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed00000000000000000000000000000000000000006c63b40e0c00000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f79829c90bd2114252581567acae715cbe1b57d5cda432c5b9443999f7d24195405f2e76ba88454cc9227069ccb7b37b41215c000000003be991e5e897284cdd6043058cec00000000000000"], &(0x7f0000000880)='GPL\x00', 0x4, 0xfd90, &(0x7f00000008c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000009c0), 0x366, 0x10, &(0x7f0000000a00), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000a80)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{r3}, &(0x7f0000000b00), &(0x7f0000000b40)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000c00)=""/182, 0xb6}], 0x1}, 0x100b6) close(r3) executing program 32: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r1, &(0x7f0000000580)={&(0x7f00000005c0)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000fdff7f006110a40000000000c60000000000000095000000000000009f33ef60916e6e713f1e6b0b725ad99b817fd98cd824498949714e32f21dcc4ae5437aca55f21f3ca9e822d182054d54d53cd2b6da714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed00000000000000000000000000000000000000006c63b40e0c00000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f79829c90bd2114252581567acae715cbe1b57d5cda432c5b9443999f7d24195405f2e76ba88454cc9227069ccb7b37b41215c000000003be991e5e897284cdd6043058cec00000000000000"], &(0x7f0000000880)='GPL\x00', 0x4, 0xfd90, &(0x7f00000008c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000009c0), 0x366, 0x10, &(0x7f0000000a00), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000a80)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{r3}, &(0x7f0000000b00), &(0x7f0000000b40)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000c00)=""/182, 0xb6}], 0x1}, 0x100b6) close(r3) executing program 1: openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x101000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES64], 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x10, 0x803, 0x0) syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x8942) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000611930000000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socket$netlink(0x10, 0x3, 0x4) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r2}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)}) executing program 1: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x1a0001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x20002, 0x80) ioctl(r5, 0x40104d04, &(0x7f0000000180)="9c81") sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./config\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') executing program 1: syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 1: r0 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x24, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0xffe0}, {0xb, 0x1}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x24008814}, 0x8090) executing program 1: r0 = syz_usb_connect(0x3, 0x50, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000405205105500000102000109023e00010100803209040000040806620007050102"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x39, &(0x7f0000000500)=""/57) executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x1, 0x42, 0x2, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r0}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x8000, r1, 0x0, 0xf2ffffffffffffff}, 0x38) executing program 33: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x1, 0x42, 0x2, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r0}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x8000, r1, 0x0, 0xf2ffffffffffffff}, 0x38) executing program 5: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), 0x0, 0x14a0, &(0x7f0000000580)=ANY=[], 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 6: syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ff"], 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000040)='1', 0x1) executing program 0: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 0: r0 = add_key$keyring(&(0x7f0000019a00), &(0x7f0000019a40)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000019a80), &(0x7f0000019ac0)={'syz', 0x3}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000019b00), &(0x7f0000019b40)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$KEYCTL_MOVE(0x1e, r1, r1, r0, 0x0) executing program 0: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='270', 0x3) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) setns(0xffffffffffffffff, 0x10000000) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r3}, [@snapshot={0x0, 0x1008, 0x0, 0x48, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '128'}}]}) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f00000002c0)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000340)={0x0, 0x20fb87, 0x800, 0xfffffffe, 0x32c}, 0x0, 0x1, &(0x7f0000000a00)={0x2e, 0x0, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) executing program 4: syz_mount_image$iso9660(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x208007, &(0x7f0000000180)=ANY=[], 0x3, 0x597, &(0x7f00000004c0)="$eJzs3c9v2+Ydx/EPXTt2NCAbtiEIAid9mmyAA7gqJTcOjJ446pHNViIFkmrtUxE0cmFE7opkAxZftlyyDdj+iF5333XYfdf9G8V6GnbTQFKy5ehX4jiRE7xfQsJH5Jd8vpQFffHY4kMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5fs11K44aQdjeNZP5tThqjq7WolQ0+u6cWkzpV3Kyf1pZ0bVi1bWfn2y+mv13S6vFs1WtZIsVHf3o6k8++dniwmD/KQm/EY+fHD283+12Hs07kTnZtmGQREHT27YmSCKzdVnSTj0x9aBhk70ktU3jx9ZLo9is+XdMZWtrw9jyXtQOt2teww5W3vuw6rqb5tNyy3pxEoUffVpO/J2g0QjC7Twm25zF3MveiJ8FqUmt1zRm/6Db2ZiVZBZUeZGg6qygqlutVirVamXz7tbde667OLLCPeHIdV2NRMz/TYv5OudPcODsFvr1Xw0FCtXWrszYh6+aYkVqjmy5JGmk/v/yIzu13+H6n1f5nlavnWy+rrz+3yye3ZxU/yfkOuWxJJ1hr+cflwbHeKwnOtJD3VdXXXX06CRm/Vx6uuCPbVmFCpQoUqCmvHyN6a8x2tKmNuXqS+2orkRGdQVqyCrRnhKlsvk7ylesZXlKFSmW0Zp83ZFRRb3lLW3IyKqsPUVqK9S2avLyo+zrIH/dN6bkeBxUmRL0xeCdV50S9FL1Pze8y7+o/6D+4yLpDer/896bRzYAAAAAAOB1cPLfvmfj/yXdkJYc1YOGdeedFgAAAAAAOEf5X/5Xs0X+zbgbchj/AwAAAADwrnHya+wcSSW9X7QGl0v1fwnQ+/G8cwQAAAAAAK8m//v/zWxRylrvy3l+/A8AAAAAAN52f5o0x/4/pV5/WsBl5x//URwvOU9bu79wDr1snXfYnyBwZJ7AtH7dudI/SL7YXOw/8+2q05/98ngSzO/7i/1Zc/0755CA/qIPipgPHhTLB4MtRS+letCwZT9qfFKR511ZSO1u+ttvDn6n/PT/HDavOD/sH3Q75a9+3X2Q5/I0O8rTw/4rNTKP4pRcfqMbRcyN8We8lF+I0e+35Cjr1x0+/4Vi94WX6POZbhUxt0rFsnT6/FeyPivlSWdfZLEs6ZXO/JluFzG3124XizFZVGdk0akOv/5nei1eIIuNaVksH3Q7G6+YBQDMy/70KpR773TdPcOn3EtV9+WzVvdnWiti1q7nH6yL18d8oruz6oo7pq6vHHe/OMii9/sJWfxt5B5Ik2ps1u9fj/ut5P1+l+3w3cSqmjSqjla+/W+vd/itrj5+cvThweH9rztfd76pVjc23Y9d925VS/lp9BfUHgDAGLPvsTMzwvm4P6q+PGFU/dPjrxSU9ZX0v17vgdbzqw3ybxyMPWop3+eH/GsI6zNGraWhO7yszxjVncRWXyJ24038KAAAeGNuzajDk+u/M7iLn7M+Y9xdGvpK4frw6PiSRkbHw7UcAAC8Hjb+3imlf3TiOGh9WdnaqnjpjjVx5H9m4qC2bU0Qpjb2d7xw25pWHKWRHzWyxudBzSYmabdaUZyaehSbVpQEu/md303/1u+JbXphGvhJq2G9xBo/ClPPT00tSHzTav+qESQ7Ns53TlrWD+qB76VBFJokase+LRuTWDsUGNRsmAb1IGuGphUHTS/eM59HjXbTmppN/DhopVFxwEFfQViP4mZ+2PK8X2wAAC6Ix0+OHt7vdjuPBg1n8fk1r9yY9zkCAIDTqNIAAAAAAAAAAAAAAAAAAAAAAFx853aR3zvVWH4dR/5CryPVy5Kmx/y7JA2v6fVetIuFi/CzONUYTDo9JebvYzZJ+sP8k3+7GuM+LUbmowbwFvt/AAAA///OdlQ+") syz_mount_image$exfat(0x0, &(0x7f0000006800)='./bus\x00', 0xe1c00, 0x0, 0x0, 0x0, &(0x7f0000006840)) executing program 2: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x1a0001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x20002, 0x80) ioctl(r5, 0x40104d04, &(0x7f0000000180)="9c81") sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') executing program 5: timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000480), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000005c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000640)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003440)=[{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000280)="0531c9ed62aeb42fde8c0a136359023956c6328bd79c9f717640bcc292f258", 0x1f}, {&(0x7f00000002c0)="e974e2f73c340e59826162c619679eb2d893b8e2adb5e8a53a", 0x19}, {&(0x7f0000001ac0)="e3b9b29036b43ae4e44d369be058f67468c169a41a21e9138ef649fbbb3bfe69b1a3a17491d7804854eb91d90a1e3b8319447572f30d8befc5ee8f1ade64351948f86fbc69dd3fae55168e70d7698bd65b682deeb1e3878c6d35a98be44d850a4723e0a0baf1ce943f28a636729346502e72b2c6bd286df11aebcc7ce224fe7ff34a899e5febafa0180120258dc9a9c3bfa3441f92a64b7be1e6acaf5842cdaa8a98dc71b24976464583fde6922ecef25a3a9847f0239eac44bd255eb89e6ac77ab9f5f549294f2e89cc", 0xca}, {&(0x7f0000001bc0)="694872d2b63b4fd2835faca2cf06bd09110ac031f6a59b1324efae0e226c2c16ec5a7238d30c02e5677b4f9626ee4b575553f3698c9633e7f1bfa8ca3d0cb3559c736e1e7a", 0x45}, {&(0x7f0000001c40)="edc1dd49360d850f534dfd63a888bbda5375154634507199fd061d11", 0x1c}, {&(0x7f0000001cc0)}], 0x6, 0x0, 0x0, 0x4880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)=""/4105, 0x1009}, {&(0x7f0000001a00)=""/176, 0xb0}], 0x2}, 0x4}], 0x1, 0x40002020, 0x0) executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYRESHEX], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$SNDCTL_TMR_TEMPO(0xffffffffffffffff, 0xc0045405, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'tunl0\x00'}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_setup(0xaae, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x400000, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, &(0x7f0000000180)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) openat$tun(0xffffffffffffff9c, 0x0, 0xa0800, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x20) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000780)='numa_maps\x00') read$FUSE(r3, &(0x7f0000000880)={0x2020}, 0x2020) executing program 5: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x6, @private0, 0xee}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/icmp6\x00') preadv(r1, &(0x7f0000000380)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1, 0xa3, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x14a0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 4: openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x4175, &(0x7f0000000100)={0x0, 0x136f, 0x10000, 0x3, 0x2d0}, 0x0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000280)="e2", 0xff0f) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 5: r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x41, 0x1ff) fcntl$setlease(r1, 0x400, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) program crashed: KASAN: use-after-free Read in nfsd_svc bisect: bisecting 44 programs bisect: split chunks (needed=false): <43> bisect: split chunk #0 of len 43 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 7, 7, 4, 18, 8, 4, 13, 13, 17, 7, 13, 18, 18, 5, 2, 27, 9, 11, 6, 24, 4, 7, 12, 13, 7, 10, 17, 18] detailed listing: executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), 0x0, 0x14a0, &(0x7f0000000580)=ANY=[], 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 6: syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ff"], 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000040)='1', 0x1) executing program 0: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 0: r0 = add_key$keyring(&(0x7f0000019a00), &(0x7f0000019a40)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000019a80), &(0x7f0000019ac0)={'syz', 0x3}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000019b00), &(0x7f0000019b40)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$KEYCTL_MOVE(0x1e, r1, r1, r0, 0x0) executing program 0: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='270', 0x3) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) setns(0xffffffffffffffff, 0x10000000) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r3}, [@snapshot={0x0, 0x1008, 0x0, 0x48, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '128'}}]}) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f00000002c0)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000340)={0x0, 0x20fb87, 0x800, 0xfffffffe, 0x32c}, 0x0, 0x1, &(0x7f0000000a00)={0x2e, 0x0, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) executing program 4: syz_mount_image$iso9660(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x208007, &(0x7f0000000180)=ANY=[], 0x3, 0x597, &(0x7f00000004c0)="$eJzs3c9v2+Ydx/EPXTt2NCAbtiEIAid9mmyAA7gqJTcOjJ446pHNViIFkmrtUxE0cmFE7opkAxZftlyyDdj+iF5333XYfdf9G8V6GnbTQFKy5ehX4jiRE7xfQsJH5Jd8vpQFffHY4kMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5fs11K44aQdjeNZP5tThqjq7WolQ0+u6cWkzpV3Kyf1pZ0bVi1bWfn2y+mv13S6vFs1WtZIsVHf3o6k8++dniwmD/KQm/EY+fHD283+12Hs07kTnZtmGQREHT27YmSCKzdVnSTj0x9aBhk70ktU3jx9ZLo9is+XdMZWtrw9jyXtQOt2teww5W3vuw6rqb5tNyy3pxEoUffVpO/J2g0QjC7Twm25zF3MveiJ8FqUmt1zRm/6Db2ZiVZBZUeZGg6qygqlutVirVamXz7tbde667OLLCPeHIdV2NRMz/TYv5OudPcODsFvr1Xw0FCtXWrszYh6+aYkVqjmy5JGmk/v/yIzu13+H6n1f5nlavnWy+rrz+3yye3ZxU/yfkOuWxJJ1hr+cflwbHeKwnOtJD3VdXXXX06CRm/Vx6uuCPbVmFCpQoUqCmvHyN6a8x2tKmNuXqS+2orkRGdQVqyCrRnhKlsvk7ylesZXlKFSmW0Zp83ZFRRb3lLW3IyKqsPUVqK9S2avLyo+zrIH/dN6bkeBxUmRL0xeCdV50S9FL1Pze8y7+o/6D+4yLpDer/896bRzYAAAAAAOB1cPLfvmfj/yXdkJYc1YOGdeedFgAAAAAAOEf5X/5Xs0X+zbgbchj/AwAAAADwrnHya+wcSSW9X7QGl0v1fwnQ+/G8cwQAAAAAAK8m//v/zWxRylrvy3l+/A8AAAAAAN52f5o0x/4/pV5/WsBl5x//URwvOU9bu79wDr1snXfYnyBwZJ7AtH7dudI/SL7YXOw/8+2q05/98ngSzO/7i/1Zc/0755CA/qIPipgPHhTLB4MtRS+letCwZT9qfFKR511ZSO1u+ttvDn6n/PT/HDavOD/sH3Q75a9+3X2Q5/I0O8rTw/4rNTKP4pRcfqMbRcyN8We8lF+I0e+35Cjr1x0+/4Vi94WX6POZbhUxt0rFsnT6/FeyPivlSWdfZLEs6ZXO/JluFzG3124XizFZVGdk0akOv/5nei1eIIuNaVksH3Q7G6+YBQDMy/70KpR773TdPcOn3EtV9+WzVvdnWiti1q7nH6yL18d8oruz6oo7pq6vHHe/OMii9/sJWfxt5B5Ik2ps1u9fj/ut5P1+l+3w3cSqmjSqjla+/W+vd/itrj5+cvThweH9rztfd76pVjc23Y9d925VS/lp9BfUHgDAGLPvsTMzwvm4P6q+PGFU/dPjrxSU9ZX0v17vgdbzqw3ybxyMPWop3+eH/GsI6zNGraWhO7yszxjVncRWXyJ24038KAAAeGNuzajDk+u/M7iLn7M+Y9xdGvpK4frw6PiSRkbHw7UcAAC8Hjb+3imlf3TiOGh9WdnaqnjpjjVx5H9m4qC2bU0Qpjb2d7xw25pWHKWRHzWyxudBzSYmabdaUZyaehSbVpQEu/md303/1u+JbXphGvhJq2G9xBo/ClPPT00tSHzTav+qESQ7Ns53TlrWD+qB76VBFJokase+LRuTWDsUGNRsmAb1IGuGphUHTS/eM59HjXbTmppN/DhopVFxwEFfQViP4mZ+2PK8X2wAAC6Ix0+OHt7vdjuPBg1n8fk1r9yY9zkCAIDTqNIAAAAAAAAAAAAAAAAAAAAAAFx853aR3zvVWH4dR/5CryPVy5Kmx/y7JA2v6fVetIuFi/CzONUYTDo9JebvYzZJ+sP8k3+7GuM+LUbmowbwFvt/AAAA///OdlQ+") syz_mount_image$exfat(0x0, &(0x7f0000006800)='./bus\x00', 0xe1c00, 0x0, 0x0, 0x0, &(0x7f0000006840)) executing program 2: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x1a0001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x20002, 0x80) ioctl(r5, 0x40104d04, &(0x7f0000000180)="9c81") sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') executing program 5: timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000480), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000005c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000640)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003440)=[{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000280)="0531c9ed62aeb42fde8c0a136359023956c6328bd79c9f717640bcc292f258", 0x1f}, {&(0x7f00000002c0)="e974e2f73c340e59826162c619679eb2d893b8e2adb5e8a53a", 0x19}, {&(0x7f0000001ac0)="e3b9b29036b43ae4e44d369be058f67468c169a41a21e9138ef649fbbb3bfe69b1a3a17491d7804854eb91d90a1e3b8319447572f30d8befc5ee8f1ade64351948f86fbc69dd3fae55168e70d7698bd65b682deeb1e3878c6d35a98be44d850a4723e0a0baf1ce943f28a636729346502e72b2c6bd286df11aebcc7ce224fe7ff34a899e5febafa0180120258dc9a9c3bfa3441f92a64b7be1e6acaf5842cdaa8a98dc71b24976464583fde6922ecef25a3a9847f0239eac44bd255eb89e6ac77ab9f5f549294f2e89cc", 0xca}, {&(0x7f0000001bc0)="694872d2b63b4fd2835faca2cf06bd09110ac031f6a59b1324efae0e226c2c16ec5a7238d30c02e5677b4f9626ee4b575553f3698c9633e7f1bfa8ca3d0cb3559c736e1e7a", 0x45}, {&(0x7f0000001c40)="edc1dd49360d850f534dfd63a888bbda5375154634507199fd061d11", 0x1c}, {&(0x7f0000001cc0)}], 0x6, 0x0, 0x0, 0x4880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)=""/4105, 0x1009}, {&(0x7f0000001a00)=""/176, 0xb0}], 0x2}, 0x4}], 0x1, 0x40002020, 0x0) executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYRESHEX], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$SNDCTL_TMR_TEMPO(0xffffffffffffffff, 0xc0045405, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'tunl0\x00'}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_setup(0xaae, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x400000, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, &(0x7f0000000180)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) openat$tun(0xffffffffffffff9c, 0x0, 0xa0800, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x20) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000780)='numa_maps\x00') read$FUSE(r3, &(0x7f0000000880)={0x2020}, 0x2020) executing program 5: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x6, @private0, 0xee}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/icmp6\x00') preadv(r1, &(0x7f0000000380)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1, 0xa3, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x14a0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 4: openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x4175, &(0x7f0000000100)={0x0, 0x136f, 0x10000, 0x3, 0x2d0}, 0x0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000280)="e2", 0xff0f) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 5: r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x41, 0x1ff) fcntl$setlease(r1, 0x400, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 27, 9, 11, 6, 24, 4, 7, 12, 13, 7, 10, 17, 18] detailed listing: executing program 4: syz_mount_image$iso9660(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x208007, &(0x7f0000000180)=ANY=[], 0x3, 0x597, &(0x7f00000004c0)="$eJzs3c9v2+Ydx/EPXTt2NCAbtiEIAid9mmyAA7gqJTcOjJ446pHNViIFkmrtUxE0cmFE7opkAxZftlyyDdj+iF5333XYfdf9G8V6GnbTQFKy5ehX4jiRE7xfQsJH5Jd8vpQFffHY4kMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5fs11K44aQdjeNZP5tThqjq7WolQ0+u6cWkzpV3Kyf1pZ0bVi1bWfn2y+mv13S6vFs1WtZIsVHf3o6k8++dniwmD/KQm/EY+fHD283+12Hs07kTnZtmGQREHT27YmSCKzdVnSTj0x9aBhk70ktU3jx9ZLo9is+XdMZWtrw9jyXtQOt2teww5W3vuw6rqb5tNyy3pxEoUffVpO/J2g0QjC7Twm25zF3MveiJ8FqUmt1zRm/6Db2ZiVZBZUeZGg6qygqlutVirVamXz7tbde667OLLCPeHIdV2NRMz/TYv5OudPcODsFvr1Xw0FCtXWrszYh6+aYkVqjmy5JGmk/v/yIzu13+H6n1f5nlavnWy+rrz+3yye3ZxU/yfkOuWxJJ1hr+cflwbHeKwnOtJD3VdXXXX06CRm/Vx6uuCPbVmFCpQoUqCmvHyN6a8x2tKmNuXqS+2orkRGdQVqyCrRnhKlsvk7ylesZXlKFSmW0Zp83ZFRRb3lLW3IyKqsPUVqK9S2avLyo+zrIH/dN6bkeBxUmRL0xeCdV50S9FL1Pze8y7+o/6D+4yLpDer/896bRzYAAAAAAOB1cPLfvmfj/yXdkJYc1YOGdeedFgAAAAAAOEf5X/5Xs0X+zbgbchj/AwAAAADwrnHya+wcSSW9X7QGl0v1fwnQ+/G8cwQAAAAAAK8m//v/zWxRylrvy3l+/A8AAAAAAN52f5o0x/4/pV5/WsBl5x//URwvOU9bu79wDr1snXfYnyBwZJ7AtH7dudI/SL7YXOw/8+2q05/98ngSzO/7i/1Zc/0755CA/qIPipgPHhTLB4MtRS+letCwZT9qfFKR511ZSO1u+ttvDn6n/PT/HDavOD/sH3Q75a9+3X2Q5/I0O8rTw/4rNTKP4pRcfqMbRcyN8We8lF+I0e+35Cjr1x0+/4Vi94WX6POZbhUxt0rFsnT6/FeyPivlSWdfZLEs6ZXO/JluFzG3124XizFZVGdk0akOv/5nei1eIIuNaVksH3Q7G6+YBQDMy/70KpR773TdPcOn3EtV9+WzVvdnWiti1q7nH6yL18d8oruz6oo7pq6vHHe/OMii9/sJWfxt5B5Ik2ps1u9fj/ut5P1+l+3w3cSqmjSqjla+/W+vd/itrj5+cvThweH9rztfd76pVjc23Y9d925VS/lp9BfUHgDAGLPvsTMzwvm4P6q+PGFU/dPjrxSU9ZX0v17vgdbzqw3ybxyMPWop3+eH/GsI6zNGraWhO7yszxjVncRWXyJ24038KAAAeGNuzajDk+u/M7iLn7M+Y9xdGvpK4frw6PiSRkbHw7UcAAC8Hjb+3imlf3TiOGh9WdnaqnjpjjVx5H9m4qC2bU0Qpjb2d7xw25pWHKWRHzWyxudBzSYmabdaUZyaehSbVpQEu/md303/1u+JbXphGvhJq2G9xBo/ClPPT00tSHzTav+qESQ7Ns53TlrWD+qB76VBFJokase+LRuTWDsUGNRsmAb1IGuGphUHTS/eM59HjXbTmppN/DhopVFxwEFfQViP4mZ+2PK8X2wAAC6Ix0+OHt7vdjuPBg1n8fk1r9yY9zkCAIDTqNIAAAAAAAAAAAAAAAAAAAAAAFx853aR3zvVWH4dR/5CryPVy5Kmx/y7JA2v6fVetIuFi/CzONUYTDo9JebvYzZJ+sP8k3+7GuM+LUbmowbwFvt/AAAA///OdlQ+") syz_mount_image$exfat(0x0, &(0x7f0000006800)='./bus\x00', 0xe1c00, 0x0, 0x0, 0x0, &(0x7f0000006840)) executing program 2: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x1a0001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x20002, 0x80) ioctl(r5, 0x40104d04, &(0x7f0000000180)="9c81") sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') executing program 5: timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000480), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000005c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000640)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003440)=[{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000280)="0531c9ed62aeb42fde8c0a136359023956c6328bd79c9f717640bcc292f258", 0x1f}, {&(0x7f00000002c0)="e974e2f73c340e59826162c619679eb2d893b8e2adb5e8a53a", 0x19}, {&(0x7f0000001ac0)="e3b9b29036b43ae4e44d369be058f67468c169a41a21e9138ef649fbbb3bfe69b1a3a17491d7804854eb91d90a1e3b8319447572f30d8befc5ee8f1ade64351948f86fbc69dd3fae55168e70d7698bd65b682deeb1e3878c6d35a98be44d850a4723e0a0baf1ce943f28a636729346502e72b2c6bd286df11aebcc7ce224fe7ff34a899e5febafa0180120258dc9a9c3bfa3441f92a64b7be1e6acaf5842cdaa8a98dc71b24976464583fde6922ecef25a3a9847f0239eac44bd255eb89e6ac77ab9f5f549294f2e89cc", 0xca}, {&(0x7f0000001bc0)="694872d2b63b4fd2835faca2cf06bd09110ac031f6a59b1324efae0e226c2c16ec5a7238d30c02e5677b4f9626ee4b575553f3698c9633e7f1bfa8ca3d0cb3559c736e1e7a", 0x45}, {&(0x7f0000001c40)="edc1dd49360d850f534dfd63a888bbda5375154634507199fd061d11", 0x1c}, {&(0x7f0000001cc0)}], 0x6, 0x0, 0x0, 0x4880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)=""/4105, 0x1009}, {&(0x7f0000001a00)=""/176, 0xb0}], 0x2}, 0x4}], 0x1, 0x40002020, 0x0) executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYRESHEX], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$SNDCTL_TMR_TEMPO(0xffffffffffffffff, 0xc0045405, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'tunl0\x00'}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_setup(0xaae, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x400000, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, &(0x7f0000000180)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) openat$tun(0xffffffffffffff9c, 0x0, 0xa0800, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x20) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000780)='numa_maps\x00') read$FUSE(r3, &(0x7f0000000880)={0x2020}, 0x2020) executing program 5: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x6, @private0, 0xee}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/icmp6\x00') preadv(r1, &(0x7f0000000380)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1, 0xa3, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x14a0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 4: openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x4175, &(0x7f0000000100)={0x0, 0x136f, 0x10000, 0x3, 0x2d0}, 0x0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000280)="e2", 0xff0f) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 5: r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x41, 0x1ff) fcntl$setlease(r1, 0x400, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 7, 7, 4, 18, 8, 4, 13, 13, 17, 7, 13, 18, 18, 5, 7] detailed listing: executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f0000000600)="ee64", 0x2}], 0x2) executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 6: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x800880, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000500), 0x0, 0x14a0, &(0x7f0000000580)=ANY=[], 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file7\x00', 0x8920a0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x0) executing program 6: syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ff"], 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000040)='1', 0x1) executing program 0: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000380)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000480)=[{r1, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000004c0)=0x3) executing program 0: r0 = add_key$keyring(&(0x7f0000019a00), &(0x7f0000019a40)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000019a80), &(0x7f0000019ac0)={'syz', 0x3}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000019b00), &(0x7f0000019b40)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$KEYCTL_MOVE(0x1e, r1, r1, r0, 0x0) executing program 0: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='270', 0x3) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) setns(0xffffffffffffffff, 0x10000000) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r3}, [@snapshot={0x0, 0x1008, 0x0, 0x48, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '128'}}]}) executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f00000002c0)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000340)={0x0, 0x20fb87, 0x800, 0xfffffffe, 0x32c}, 0x0, 0x1, &(0x7f0000000a00)={0x2e, 0x0, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <15> bisect: split chunk #0 of len 15 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 17, 7, 13, 18, 18, 5, 7] detailed listing: executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f00000002c0)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000340)={0x0, 0x20fb87, 0x800, 0xfffffffe, 0x32c}, 0x0, 0x1, &(0x7f0000000a00)={0x2e, 0x0, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: KASAN: use-after-free Read in nfsd_svc bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <7> bisect: split chunk #0 of len 7 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 18, 5, 7] detailed listing: executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x10106, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000800)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000840)=0x7) recvmsg$unix(0xffffffffffffffff, 0x0, 0x40000062) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000008c0)=@file={0x0, './cfg\x00'}, 0x61) sendmmsg$unix(r2, &(0x7f0000000940), 0x651, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x10, 0x4, &(0x7f0000000e40)=ANY=[], &(0x7f0000000ec0)='GPL\x00', 0x2, 0xc3, &(0x7f0000001000)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f00000009c0)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./cfg\x00', &(0x7f0000000a80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f00000002c0)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000340)={0x0, 0x20fb87, 0x800, 0xfffffffe, 0x32c}, 0x0, 0x1, &(0x7f0000000a00)={0x2e, 0x0, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 17, 7, 13, 7] detailed listing: executing program 2: socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000ac0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000b00)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x204}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf0b, 0x2, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2ba}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000d"], 0x38}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x17}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000880), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000008c0), 0x2, 0x141102) writev(r3, &(0x7f0000000900)=[{&(0x7f0000000940)="94", 0xf000}, {0x0}], 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000ac0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000b00)=0x200) write$dsp(r4, &(0x7f0000000b40)="5cba91a4", 0xffffffd9) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 13, 7] detailed listing: executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: KASAN: use-after-free Read in nfsd_svc bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7] detailed listing: executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 7] detailed listing: executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash bisect: split chunks (needed=true): <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 3 programs left: executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) bisect: trying to concatenate bisect: concatenate 3 entries minimizing program #0 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 13, 7] detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f00000009c0)='1', 0x1) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: KASAN: use-after-free Read in nfsd_svc testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 13, 7] detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: KASAN: use-after-free Read in nfsd_svc testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13, 7] detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13, 7] detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13, 7] detailed listing: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13, 7] detailed listing: executing program 0: setns(0xc9, 0x0) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy minimized 7 calls -> 4 calls minimizing program #1 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 12, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000028c0)={0x1, &(0x7f0000002900)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_open_dev$usbmon(&(0x7f0000002880), 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 9, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000680), 0x10106, 0x2, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000640), 0x651, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) connect$unix(r0, &(0x7f00000005c0)=@abs, 0x6e) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x7) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) getpid() executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x100}, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 1, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8000, &(0x7f00000000c0)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000280)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 7] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 6: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) program crashed: kernel BUG in svc_destroy minimized 13 calls -> 0 calls minimizing program #2 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 6] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000009c0)='1', 0x1) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 5] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 4] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 3] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 2] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 1] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: setns(0xc9, 0x0) program crashed: kernel BUG in svc_destroy testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0, 0] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) executing program 0: executing program 0: program crashed: kernel BUG in svc_destroy minimized 7 calls -> 0 calls testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy bisect: concatenation succeeded found reproducer with 4 syscalls minimizing guilty program testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, 0x0, &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m19.077589896s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy simplifying C reproducer testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy validation run: crashed=true testing program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy validation run: crashed=true testing program (duration=1m19.077589896s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy validation run: crashed=true reproducing took 1h39m6.059900208s repro crashed as (corrupted=false): ------------[ cut here ]------------ kernel BUG at net/sunrpc/svc.c:605! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4450 Comm: syz.0.18 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605 Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53 RSP: 0018:ffffc90003497b10 EFLAGS: 00010293 RAX: ffffffff895c5804 RBX: ffff88807d78e850 RCX: ffff88807ce11e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff88807d78e868 R15: 0000000000000001 FS: 0000555575274500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbcd64716a0 CR3: 000000002786e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline] __write_ports fs/nfsd/nfsctl.c:794 [inline] write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x2dc/0x9a0 fs/read_write.c:582 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fbcd659fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc9cd8f578 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fbcd6825fa0 RCX: 00007fbcd659fb19 RDX: 0000000000000005 RSI: 0000200000000940 RDI: 0000000000000003 RBP: 00007fbcd6637b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fbcd6825fac R14: 00007fbcd6825fa0 R15: 00007fbcd6825fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605 Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53 RSP: 0018:ffffc90003497b10 EFLAGS: 00010293 RAX: ffffffff895c5804 RBX: ffff88807d78e850 RCX: ffff88807ce11e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff88807d78e868 R15: 0000000000000001 FS: 0000555575274500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbcd64716a0 CR3: 000000002786e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 final repro crashed as (corrupted=false): ------------[ cut here ]------------ kernel BUG at net/sunrpc/svc.c:605! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4450 Comm: syz.0.18 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605 Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53 RSP: 0018:ffffc90003497b10 EFLAGS: 00010293 RAX: ffffffff895c5804 RBX: ffff88807d78e850 RCX: ffff88807ce11e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff88807d78e868 R15: 0000000000000001 FS: 0000555575274500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbcd64716a0 CR3: 000000002786e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline] __write_ports fs/nfsd/nfsctl.c:794 [inline] write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x2dc/0x9a0 fs/read_write.c:582 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fbcd659fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc9cd8f578 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fbcd6825fa0 RCX: 00007fbcd659fb19 RDX: 0000000000000005 RSI: 0000200000000940 RDI: 0000000000000003 RBP: 00007fbcd6637b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fbcd6825fac R14: 00007fbcd6825fa0 R15: 00007fbcd6825fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605 Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53 RSP: 0018:ffffc90003497b10 EFLAGS: 00010293 RAX: ffffffff895c5804 RBX: ffff88807d78e850 RCX: ffff88807ce11e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff88807d78e868 R15: 0000000000000001 FS: 0000555575274500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbcd64716a0 CR3: 000000002786e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400