Extracting prog: 51m17.567845625s
Minimizing prog: 18m48.993622691s
Simplifying prog options: 0s
Extracting C: 1m16.760306153s
Simplifying C: 11m56.590988099s


extracting reproducer from 18 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdirat-mkdirat-mknodat-landlock_create_ruleset-openat$dir-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-landlock_restrict_self-socket$kcm-sendmsg$kcm-syz_open_dev$vbi-ioctl$VIDIOC_S_INPUT-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$wireguard-ioctl$KVM_CREATE_VCPU-socket$tipc-bind$tipc-socket$tipc-bind$tipc-bind$tipc-socket$tipc-bind$tipc-setsockopt$TIPC_GROUP_JOIN-bind$tipc-sendmsg$nl_route-close-syz_usb_connect-ioctl$KVM_SET_VCPU_EVENTS
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-syz_clone-mprotect
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect-syz_usb_disconnect-syz_usb_control_io$hid-syz_open_dev$hidraw-syz_open_dev$hidraw-ioctl$HIDIOCGRDESC
detailed listing:
executing program 0:
syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000680)=ANY=[@ANYBLOB="120100020000002082057d004000010203010902600003010680070904000000010100000a2401a80f0a0002010209040100000102000009040101010102000104050100090402"], 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000ec31f8104c1302007eec0102030109021b0001000000000904002c11018b75000905", @ANYRES32], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0xffffff5a, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x50, &(0x7f0000000200)=@string={0x50, 0x3, "e3cd3107eae0ed2fd1028289a54649ae4801551057cb876947d795a8189e5ef99ba1c1beff8b7ad87858eee6ae04d805361d71b0f98feb4de9e05c9a21dbea57676b5552a4e236ed63d24c389605"}}]})
syz_usb_disconnect(r2)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="00000c000000070001d9"], 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000040), 0x31bc1c98, 0x40)
r3 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
ioctl$HIDIOCGRDESC(r3, 0x4004480d, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_EXP_NEW-mmap$IORING_OFF_SQ_RING-syz_clone-syz_usb_connect$uac3-socket$inet_tcp-setsockopt$inet_tcp_int-connect$inet-sendmmsg$unix-recvmmsg-sched_setattr-socket-sendmsg$inet_sctp-madvise-madvise-socket$netlink-bind$netlink-setsockopt$netlink_NETLINK_BROADCAST_ERROR-setsockopt$sock_int-socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_NEW-socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_DELETE-sendmsg$IPCTNL_MSG_CT_GET_DYING-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="d00000000002010400000000000000000a000000440001802c00018014110300fe8000000000000000000000000000201400ffffff0200000000000000000000000000010c000280050001009800000006000340000300003c0003800c00028005000100890000002c00018014000300fe80000000000000000000000000002a14000400ff0100000000000000000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000020c000280050001"], 0xd0}, 0x1, 0x0, 0x0, 0x24000801}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_connect$uac3(0x0, 0xa0, 0x0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r2 = socket(0xa, 0x5, 0x0)
sendmsg$inet_sctp(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084001b000800000020010000"], 0x58, 0xc855}, 0x24000052)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc020000000000000000"], 0xd8}, 0x1, 0x0, 0x0, 0x40c1}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2004c0b0}, 0x20000000)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x88)
sendmsg$NFT_BATCH(r6, 0x0, 0x8044)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$printer-syz_usb_control_io$printer-syz_usb_control_io-syz_usb_control_io$printer-syz_open_dev$char_usb-write$char_usb-close
detailed listing:
executing program 0:
r0 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
write$char_usb(r1, &(0x7f00000007c0), 0x0)
close(0x3)

program did not crash
single: failed to extract reproducer
bisect: bisecting 18 programs with base timeout 30s
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 10, 10, 7, 4, 12, 19, 7, 6, 7, 7, 3, 5, 27, 10, 13, 9, 29]
detailed listing:
executing program 1:
r0 = syz_open_dev$usbmon(&(0x7f0000002a40), 0x0, 0x80000)
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000e40)={0xa, 0x1, 0x200, "3a8e0300d614000001000100000040004000000000000016c713b41e2a3600", 0x7d04651e})
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000002ac0)={&(0x7f0000000000)=[0x0], 0x1})
socket$inet_udp(0x2, 0x2, 0x0)
r2 = epoll_create(0xeb5)
r3 = syz_open_dev$sndpcmp(&(0x7f0000000700), 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f00000000c0)={0x10000000})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80202, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x10010, 0xffffffffffffffff, 0x0)
ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f00000001c0))
bpf$MAP_CREATE(0x0, 0x0, 0x10)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
fsopen(0x0, 0x1)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe)
mremap(&(0x7f0000bb9000/0x4000)=nil, 0x4000, 0x2000, 0x2, &(0x7f0000ffd000/0x2000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x1, 0x2)
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0xd3, 0xd, 0xd9, 0x40, 0xe8d, 0x7925, 0xbbbe, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfc, 0x21, 0x70, 0xe0, "", [{{0x9, 0x4, 0x7a, 0x7, 0x0, 0xff, 0xff, 0xff, 0x6}}]}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc70, 0xf014, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r0, &(0x7f0000000280)={0x14, 0x0, 0x0}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x52, &(0x7f0000000500)=@generic={0x3, 0x2, 0x4a, "6a48d2cd", "fa92c21eb4e56ec1d6bccee1351427d0669100e743e29420cd67cee0502567b23451e4a46b94ef18357e3dc712915635a2cc5d05d07a28984892a0fc9ca5176e68321e33815d4a5c593c"})
executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x2)
ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000340)=0x5)
r1 = syz_usb_connect(0x0, 0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040b90661400001010203010902320002010080320904000000ff0000000904010000ff0000000904010102ff0000004b00000040000007050702400000"], 0x0)
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000240), 0x3, 0x107100)
ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000280)=""/102)
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x5}, 0x48)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 0:
socket$can_raw(0x1d, 0x3, 0x1)
socket(0x18, 0x80000, 0x1)
socket$key(0xf, 0x3, 0x2)
syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00')
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00')
socket$inet_udp(0x2, 0x2, 0x0)
syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0)
r1 = epoll_create1(0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r2], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0)
sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x20)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x50, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {}, {0x10, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1e7}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0xe6a7, 0x1e7}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x0)
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10)
connect$inet(r1, 0x0, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendmmsg(r0, &(0x7f0000004380)=[{{0x0, 0x810, 0x0}}], 0x34000, 0x0)
executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x22, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fcffffff0000000007000000850000009e"], 0x0, 0x545, 0x0, 0x0, 0x40f00, 0x34}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd45, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0xc000, 0x0}, 0x20000000)
ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x40047451, &(0x7f00000002c0))
executing program 2:
r0 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
write$char_usb(r1, &(0x7f00000007c0), 0x0)
close(0x3)
executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1ca8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc)
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="d00000000002010400000000000000000a000000440001802c00018014110300fe8000000000000000000000000000201400ffffff0200000000000000000000000000010c000280050001009800000006000340000300003c0003800c00028005000100890000002c00018014000300fe80000000000000000000000000002a14000400ff0100000000000000000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000020c000280050001"], 0xd0}, 0x1, 0x0, 0x0, 0x24000801}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_connect$uac3(0x0, 0xa0, 0x0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r2 = socket(0xa, 0x5, 0x0)
sendmsg$inet_sctp(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084001b000800000020010000"], 0x58, 0xc855}, 0x24000052)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc020000000000000000"], 0xd8}, 0x1, 0x0, 0x0, 0x40c1}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2004c0b0}, 0x20000000)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x88)
sendmsg$NFT_BATCH(r6, 0x0, 0x8044)
executing program 3:
syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000680)=ANY=[@ANYBLOB="120100020000002082057d004000010203010902600003010680070904000000010100000a2401a80f0a0002010209040100000102000009040101010102000104050100090402"], 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000ec31f8104c1302007eec0102030109021b0001000000000904002c11018b75000905", @ANYRES32], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0xffffff5a, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x50, &(0x7f0000000200)=@string={0x50, 0x3, "e3cd3107eae0ed2fd1028289a54649ae4801551057cb876947d795a8189e5ef99ba1c1beff8b7ad87858eee6ae04d805361d71b0f98feb4de9e05c9a21dbea57676b5552a4e236ed63d24c389605"}}]})
syz_usb_disconnect(r2)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="00000c000000070001d9"], 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000040), 0x31bc1c98, 0x40)
r3 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
ioctl$HIDIOCGRDESC(r3, 0x4004480d, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program crashed: WARNING: inconsistent lock state
bisect: bisecting 18 programs
bisect: split chunks (needed=false): <18>
bisect: split chunk #0 of len 18 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 7, 6, 7, 7, 3, 5, 27, 10, 13, 9, 29]
detailed listing:
executing program 0:
socket$can_raw(0x1d, 0x3, 0x1)
socket(0x18, 0x80000, 0x1)
socket$key(0xf, 0x3, 0x2)
syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00')
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00')
socket$inet_udp(0x2, 0x2, 0x0)
syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0)
r1 = epoll_create1(0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r2], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0)
sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x20)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x50, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {}, {0x10, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1e7}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0xe6a7, 0x1e7}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x0)
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10)
connect$inet(r1, 0x0, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendmmsg(r0, &(0x7f0000004380)=[{{0x0, 0x810, 0x0}}], 0x34000, 0x0)
executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x22, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fcffffff0000000007000000850000009e"], 0x0, 0x545, 0x0, 0x0, 0x40f00, 0x34}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd45, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0xc000, 0x0}, 0x20000000)
ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x40047451, &(0x7f00000002c0))
executing program 2:
r0 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
write$char_usb(r1, &(0x7f00000007c0), 0x0)
close(0x3)
executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1ca8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc)
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="d00000000002010400000000000000000a000000440001802c00018014110300fe8000000000000000000000000000201400ffffff0200000000000000000000000000010c000280050001009800000006000340000300003c0003800c00028005000100890000002c00018014000300fe80000000000000000000000000002a14000400ff0100000000000000000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000020c000280050001"], 0xd0}, 0x1, 0x0, 0x0, 0x24000801}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_connect$uac3(0x0, 0xa0, 0x0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r2 = socket(0xa, 0x5, 0x0)
sendmsg$inet_sctp(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084001b000800000020010000"], 0x58, 0xc855}, 0x24000052)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc020000000000000000"], 0xd8}, 0x1, 0x0, 0x0, 0x40c1}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2004c0b0}, 0x20000000)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x88)
sendmsg$NFT_BATCH(r6, 0x0, 0x8044)
executing program 3:
syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000680)=ANY=[@ANYBLOB="120100020000002082057d004000010203010902600003010680070904000000010100000a2401a80f0a0002010209040100000102000009040101010102000104050100090402"], 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000ec31f8104c1302007eec0102030109021b0001000000000904002c11018b75000905", @ANYRES32], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0xffffff5a, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x50, &(0x7f0000000200)=@string={0x50, 0x3, "e3cd3107eae0ed2fd1028289a54649ae4801551057cb876947d795a8189e5ef99ba1c1beff8b7ad87858eee6ae04d805361d71b0f98feb4de9e05c9a21dbea57676b5552a4e236ed63d24c389605"}}]})
syz_usb_disconnect(r2)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="00000c000000070001d9"], 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000040), 0x31bc1c98, 0x40)
r3 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
ioctl$HIDIOCGRDESC(r3, 0x4004480d, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 10, 10, 7, 4, 12, 5, 27, 10, 13, 9, 29]
detailed listing:
executing program 1:
r0 = syz_open_dev$usbmon(&(0x7f0000002a40), 0x0, 0x80000)
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000e40)={0xa, 0x1, 0x200, "3a8e0300d614000001000100000040004000000000000016c713b41e2a3600", 0x7d04651e})
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000002ac0)={&(0x7f0000000000)=[0x0], 0x1})
socket$inet_udp(0x2, 0x2, 0x0)
r2 = epoll_create(0xeb5)
r3 = syz_open_dev$sndpcmp(&(0x7f0000000700), 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f00000000c0)={0x10000000})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80202, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x10010, 0xffffffffffffffff, 0x0)
ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f00000001c0))
bpf$MAP_CREATE(0x0, 0x0, 0x10)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
fsopen(0x0, 0x1)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe)
mremap(&(0x7f0000bb9000/0x4000)=nil, 0x4000, 0x2000, 0x2, &(0x7f0000ffd000/0x2000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x1, 0x2)
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0xd3, 0xd, 0xd9, 0x40, 0xe8d, 0x7925, 0xbbbe, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfc, 0x21, 0x70, 0xe0, "", [{{0x9, 0x4, 0x7a, 0x7, 0x0, 0xff, 0xff, 0xff, 0x6}}]}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc70, 0xf014, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r0, &(0x7f0000000280)={0x14, 0x0, 0x0}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x52, &(0x7f0000000500)=@generic={0x3, 0x2, 0x4a, "6a48d2cd", "fa92c21eb4e56ec1d6bccee1351427d0669100e743e29420cd67cee0502567b23451e4a46b94ef18357e3dc712915635a2cc5d05d07a28984892a0fc9ca5176e68321e33815d4a5c593c"})
executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x2)
ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000340)=0x5)
r1 = syz_usb_connect(0x0, 0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040b90661400001010203010902320002010080320904000000ff0000000904010000ff0000000904010102ff0000004b00000040000007050702400000"], 0x0)
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000240), 0x3, 0x107100)
ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000280)=""/102)
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x5}, 0x48)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="d00000000002010400000000000000000a000000440001802c00018014110300fe8000000000000000000000000000201400ffffff0200000000000000000000000000010c000280050001009800000006000340000300003c0003800c00028005000100890000002c00018014000300fe80000000000000000000000000002a14000400ff0100000000000000000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000020c000280050001"], 0xd0}, 0x1, 0x0, 0x0, 0x24000801}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_connect$uac3(0x0, 0xa0, 0x0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r2 = socket(0xa, 0x5, 0x0)
sendmsg$inet_sctp(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084001b000800000020010000"], 0x58, 0xc855}, 0x24000052)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc020000000000000000"], 0xd8}, 0x1, 0x0, 0x0, 0x40c1}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2004c0b0}, 0x20000000)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x88)
sendmsg$NFT_BATCH(r6, 0x0, 0x8044)
executing program 3:
syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000680)=ANY=[@ANYBLOB="120100020000002082057d004000010203010902600003010680070904000000010100000a2401a80f0a0002010209040100000102000009040101010102000104050100090402"], 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000ec31f8104c1302007eec0102030109021b0001000000000904002c11018b75000905", @ANYRES32], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0xffffff5a, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x50, &(0x7f0000000200)=@string={0x50, 0x3, "e3cd3107eae0ed2fd1028289a54649ae4801551057cb876947d795a8189e5ef99ba1c1beff8b7ad87858eee6ae04d805361d71b0f98feb4de9e05c9a21dbea57676b5552a4e236ed63d24c389605"}}]})
syz_usb_disconnect(r2)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="00000c000000070001d9"], 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000040), 0x31bc1c98, 0x40)
r3 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
ioctl$HIDIOCGRDESC(r3, 0x4004480d, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program crashed: inconsistent lock state in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 10, 10, 7, 4, 12]
detailed listing:
executing program 1:
r0 = syz_open_dev$usbmon(&(0x7f0000002a40), 0x0, 0x80000)
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000e40)={0xa, 0x1, 0x200, "3a8e0300d614000001000100000040004000000000000016c713b41e2a3600", 0x7d04651e})
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000002ac0)={&(0x7f0000000000)=[0x0], 0x1})
socket$inet_udp(0x2, 0x2, 0x0)
r2 = epoll_create(0xeb5)
r3 = syz_open_dev$sndpcmp(&(0x7f0000000700), 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f00000000c0)={0x10000000})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80202, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x10010, 0xffffffffffffffff, 0x0)
ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f00000001c0))
bpf$MAP_CREATE(0x0, 0x0, 0x10)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
fsopen(0x0, 0x1)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe)
mremap(&(0x7f0000bb9000/0x4000)=nil, 0x4000, 0x2000, 0x2, &(0x7f0000ffd000/0x2000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x1, 0x2)
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0xd3, 0xd, 0xd9, 0x40, 0xe8d, 0x7925, 0xbbbe, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfc, 0x21, 0x70, 0xe0, "", [{{0x9, 0x4, 0x7a, 0x7, 0x0, 0xff, 0xff, 0xff, 0x6}}]}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc70, 0xf014, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r0, &(0x7f0000000280)={0x14, 0x0, 0x0}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x52, &(0x7f0000000500)=@generic={0x3, 0x2, 0x4a, "6a48d2cd", "fa92c21eb4e56ec1d6bccee1351427d0669100e743e29420cd67cee0502567b23451e4a46b94ef18357e3dc712915635a2cc5d05d07a28984892a0fc9ca5176e68321e33815d4a5c593c"})
executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x2)
ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000340)=0x5)
r1 = syz_usb_connect(0x0, 0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040b90661400001010203010902320002010080320904000000ff0000000904010000ff0000000904010102ff0000004b00000040000007050702400000"], 0x0)
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000240), 0x3, 0x107100)
ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000280)=""/102)
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x1a, {0x1a, 0x3, '0\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x000\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x5}, 0x48)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)

program did not crash
bisect: split chunks (needed=true): <6>, <6>
bisect: split chunk #0 of len 6 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 4, 12, 5, 27, 10, 13, 9, 29]
detailed listing:
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x5}, 0x48)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="d00000000002010400000000000000000a000000440001802c00018014110300fe8000000000000000000000000000201400ffffff0200000000000000000000000000010c000280050001009800000006000340000300003c0003800c00028005000100890000002c00018014000300fe80000000000000000000000000002a14000400ff0100000000000000000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000020c000280050001"], 0xd0}, 0x1, 0x0, 0x0, 0x24000801}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_connect$uac3(0x0, 0xa0, 0x0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r2 = socket(0xa, 0x5, 0x0)
sendmsg$inet_sctp(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084001b000800000020010000"], 0x58, 0xc855}, 0x24000052)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc020000000000000000"], 0xd8}, 0x1, 0x0, 0x0, 0x40c1}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2004c0b0}, 0x20000000)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x88)
sendmsg$NFT_BATCH(r6, 0x0, 0x8044)
executing program 3:
syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000680)=ANY=[@ANYBLOB="120100020000002082057d004000010203010902600003010680070904000000010100000a2401a80f0a0002010209040100000102000009040101010102000104050100090402"], 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000ec31f8104c1302007eec0102030109021b0001000000000904002c11018b75000905", @ANYRES32], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0xffffff5a, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x50, &(0x7f0000000200)=@string={0x50, 0x3, "e3cd3107eae0ed2fd1028289a54649ae4801551057cb876947d795a8189e5ef99ba1c1beff8b7ad87858eee6ae04d805361d71b0f98feb4de9e05c9a21dbea57676b5552a4e236ed63d24c389605"}}]})
syz_usb_disconnect(r2)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="00000c000000070001d9"], 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000040), 0x31bc1c98, 0x40)
r3 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
ioctl$HIDIOCGRDESC(r3, 0x4004480d, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program crashed: inconsistent lock state in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 6 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 4, 12, 13, 9, 29]
detailed listing:
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x5}, 0x48)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program crashed: inconsistent lock state in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <3>, <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 13, 9, 29]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x5}, 0x48)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 4, 13, 9, 29]
detailed listing:
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program crashed: inconsistent lock state in corrupted
bisect: the chunk can be dropped
bisect: split chunk #1 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 4, 29]
detailed listing:
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x77}, @exit], 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0)
r0 = landlock_create_ruleset(0x0, 0x0, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0)
landlock_restrict_self(r0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, 0x0, 0x0)
r3 = syz_open_dev$vbi(0x0, 0x2, 0x2)
ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x4}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)
syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r6 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r7 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r7, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r8, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10)
bind$tipc(r6, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r6)
syz_usb_connect(0x2, 0x18b, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0xad, 0x48, 0xe8, 0x40, 0x19d2, 0x1255, 0x3be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x179, 0x1, 0x8, 0x80, 0x30, 0x3e, "", [{{0x9, 0x4, 0x14, 0x1, 0x2, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0xae4a8fcd21e5273b, "dac9fd3c90f943cfa0ebeb68a1b318d1a3ff1d9401814d17d4323abee6aee8e9cda73f815c3b706b0510a3dc003c3b7508ae590aaf52e7e86efd18fb234c6d"}, @cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "08b384"}, {0x5, 0x24, 0x0, 0x5272}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x1, 0x3ff, 0x1}, [@mdlm_detail={0x51, 0x24, 0x13, 0x3, "c49b175a691f08451c120593e0ebaeca5ebff56561cc35764dc8f6759caf08325ddaa1ebba925821f2b41adafb4a7be69a63352fbcbdc5472e3941acb55387052b14c8be41c3268632a2059928"}]}], [{{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7}]}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0xc0, 0x1, 0x3, [@generic={0xa0, 0x23, "4848d90a8c8d97543e0751d7e9c043cb4fa7c95cd63420bbd7d6847cd98375480addf99dc4fbf6bc3c72a8f9373b4abf9a87750069d43d4c6354b48893966a5481ef7ab20d5df55126e2762cb7351c74f3d5d21f41f32716734d3e8dbf47c16c98aa61693425b09f9ab4ca599734b13baf85a78aa37a5e0c310009e6b7c55161061047893be1f5175f6b9a99135db9d7a683a295bacc644f8e76e3f1df1c"}, @generic={0x2}]}}]}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x201, 0xc7, 0x3, 0x20, 0x8, 0xa}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0x3, 0x4}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x42f}}, {0x26, &(0x7f0000000700)=@string={0x26, 0x3, "1dd92c7882bcdfba69a88dc0615f50291674aa665b7abe856d65a62ab5c967186a08ca0b"}}, {0x0, 0x0}]})
ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 4, 13, 9]
detailed listing:
executing program 4:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101)
syz_usb_disconnect(r0)
syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program crashed: inconsistent lock state in mmc_free_host
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13, 9]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4005, 0x0, 0x0, 0x0, 0x9}, [@generic={0x6b, 0x1, 0x1, 0xc}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xa, 0x4, 0x6, 0x84}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program crashed: inconsistent lock state in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 9]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program crashed: inconsistent lock state in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 9]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 9]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 9]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 9]
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)

program did not crash
minimized 4 calls -> 4 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x17, 0x0, 0x0)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 1]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)

program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:

program crashed: inconsistent lock state in mmc_free_host
minimized 9 calls -> 0 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: inconsistent lock state in mmc_free_host
bisect: concatenation succeeded
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: inconsistent lock state in mmc_free_host
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: inconsistent lock state in mmc_free_host
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: inconsistent lock state in mmc_free_host
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: inconsistent lock state in mmc_free_host
validation run: crashed=true
reproducing took 1h27m37.30211062s
repro crashed as (corrupted=false):
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff88801d290648 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0x109/0xac0 kernel/workqueue.c:3072
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
  __flush_work+0x122/0xac0 kernel/workqueue.c:3072
  __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163
  __mmc_stop_host drivers/mmc/core/core.c:2303 [inline]
  mmc_stop_host+0xd5/0x460 drivers/mmc/core/core.c:2308
  mmc_remove_host+0x11/0x60 drivers/mmc/core/host.c:651
  vub300_disconnect+0x14b/0x2e0 drivers/mmc/host/vub300.c:2388
  usb_unbind_interface+0x200/0x870 drivers/usb/core/driver.c:457
  device_remove drivers/base/dd.c:549 [inline]
  __device_release_driver drivers/base/dd.c:1279 [inline]
  device_release_driver_internal+0x4cf/0x7c0 drivers/base/dd.c:1305
  bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531
  device_del+0x63f/0xa80 drivers/base/core.c:3900
  usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472
  usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2319
  hub_port_connect drivers/usb/core/hub.c:5366 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
  port_event drivers/usb/core/hub.c:5822 [inline]
  hub_event+0x1d27/0x5200 drivers/usb/core/hub.c:5904
  process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
  process_scheduled_works kernel/workqueue.c:2355 [inline]
  worker_thread+0xd6e/0x12a0 kernel/workqueue.c:2441
  kthread+0x29d/0x330 kernel/kthread.c:376
  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
irq event stamp: 326630
hardirqs last  enabled at (326630): [<ffffffff815474da>] __cancel_work_timer+0x36a/0x560 kernel/workqueue.c:3156
hardirqs last disabled at (326629): [<ffffffff81543e7a>] try_to_grab_pending+0xfa/0x890 kernel/workqueue.c:1267
softirqs last  enabled at (326532): [<ffffffff814f4aab>] __do_softirq kernel/softirq.c:630 [inline]
softirqs last  enabled at (326532): [<ffffffff814f4aab>] invoke_softirq kernel/softirq.c:470 [inline]
softirqs last  enabled at (326532): [<ffffffff814f4aab>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
softirqs last disabled at (326563): [<ffffffff814f4aab>] __do_softirq kernel/softirq.c:630 [inline]
softirqs last disabled at (326563): [<ffffffff814f4aab>] invoke_softirq kernel/softirq.c:470 [inline]
softirqs last disabled at (326563): [<ffffffff814f4aab>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock((work_completion)(&(&host->detect)->work));
  <Interrupt>
    lock((work_completion)(&(&host->detect)->work));

 *** DEADLOCK ***

1 lock held by swapper/0/0:
 #0: ffffc90000007bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974
 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177
 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
 __flush_work+0x122/0xac0 kernel/workqueue.c:3072
 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163
 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:672
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 37 f3 96 f7 e9 44 ff ff ff e8 7d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d 77 23 4a 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6
RAX: bae1574036e3a600 RBX: ffffffff8a3c8957 RCX: bae1574036e3a600
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffffff8c807ec0 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x493/0x53c init/main.c:1112
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
BUG: sleeping function called from invalid context at kernel/workqueue.c:3013
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff8a3b27c9>] schedule_preempt_disabled+0x19/0x20 kernel/sched/core.c:6699
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970
 start_flush_work kernel/workqueue.c:3013 [inline]
 __flush_work+0x142/0xac0 kernel/workqueue.c:3075
 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163
 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:672
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 37 f3 96 f7 e9 44 ff ff ff e8 7d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d 77 23 4a 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6
RAX: bae1574036e3a600 RBX: ffffffff8a3c8957 RCX: bae1574036e3a600
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffffff8c807ec0 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x493/0x53c init/main.c:1112
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
ODEBUG: object ffffc900000079a0 is NOT on stack ffffffff8c800000, but annotated.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:558 debug_object_is_on_stack lib/debugobjects.c:-1 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:558 lookup_object_or_alloc lib/debugobjects.c:591 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:558 __debug_object_init+0x18e/0x440 lib/debugobjects.c:672
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:558 [inline]
RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:591 [inline]
RIP: 0010:__debug_object_init+0x18e/0x440 lib/debugobjects.c:672
Code: 24 04 74 2f 41 ff c6 44 89 35 7e 6a dd 12 48 c7 c1 40 71 df 8a 48 c7 c7 a0 71 df 8a 84 c0 48 0f 45 f9 48 89 de e8 f2 b9 0c 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f
RSP: 0018:ffffc90000007908 EFLAGS: 00010046
RAX: 0000000000000050 RBX: ffffc900000079a0 RCX: bae1574036e3a600
RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000007587 R09: 1ffff92000000eb0
R10: dffffc0000000000 R11: fffff52000000eb1 R12: ffffffff8c8bc760
R13: ffff88805bad4af0 R14: 0000000000000001 R15: ffffffff8a8d3120
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005568d3392430 CR3: 000000007fadd000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __synchronize_srcu+0x227/0x350 kernel/rcu/srcutree.c:1241
 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline]
 wakeup_source_unregister+0x112/0x190 drivers/base/power/wakeup.c:242
 mmc_host_classdev_release+0x43/0xf0 drivers/mmc/core/host.c:77
 device_release+0x92/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x217/0x450 lib/kobject.c:729
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 37 f3 96 f7 e9 44 ff ff ff e8 7d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d 77 23 4a 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6
RAX: bae1574036e3a600 RBX: ffffffff8a3c8957 RCX: bae1574036e3a600
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffffff8c807ec0 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x493/0x53c init/main.c:1112
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
----------------
Code disassembly (best guess):
   0:	48 89 df             	mov    %rbx,%rdi
   3:	e8 37 f3 96 f7       	call   0xf796f33f
   8:	e9 44 ff ff ff       	jmp    0xffffff51
   d:	e8 7d 03 f6 ff       	call   0xfff6038f
  12:	00 00                	add    %al,(%rax)
  14:	cc                   	int3
  15:	cc                   	int3
  16:	00 00                	add    %al,(%rax)
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	00 00                	add    %al,(%rax)
  1c:	cc                   	int3
  1d:	cc                   	int3
  1e:	00 66 90             	add    %ah,-0x70(%rsi)
  21:	0f 00 2d 77 23 4a 00 	verw   0x4a2377(%rip)        # 0x4a239f
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	0f 1f 40 00          	nopl   0x0(%rax)
  2f:	41 57                	push   %r15
  31:	41 56                	push   %r14
  33:	53                   	push   %rbx
  34:	49 be 00 00 00 00 00 	movabs $0xdffffc0000000000,%r14
  3b:	fc ff df
  3e:	65                   	gs
  3f:	48                   	rex.W

final repro crashed as (corrupted=false):
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff88801d290648 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0x109/0xac0 kernel/workqueue.c:3072
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
  __flush_work+0x122/0xac0 kernel/workqueue.c:3072
  __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163
  __mmc_stop_host drivers/mmc/core/core.c:2303 [inline]
  mmc_stop_host+0xd5/0x460 drivers/mmc/core/core.c:2308
  mmc_remove_host+0x11/0x60 drivers/mmc/core/host.c:651
  vub300_disconnect+0x14b/0x2e0 drivers/mmc/host/vub300.c:2388
  usb_unbind_interface+0x200/0x870 drivers/usb/core/driver.c:457
  device_remove drivers/base/dd.c:549 [inline]
  __device_release_driver drivers/base/dd.c:1279 [inline]
  device_release_driver_internal+0x4cf/0x7c0 drivers/base/dd.c:1305
  bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531
  device_del+0x63f/0xa80 drivers/base/core.c:3900
  usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472
  usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2319
  hub_port_connect drivers/usb/core/hub.c:5366 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
  port_event drivers/usb/core/hub.c:5822 [inline]
  hub_event+0x1d27/0x5200 drivers/usb/core/hub.c:5904
  process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
  process_scheduled_works kernel/workqueue.c:2355 [inline]
  worker_thread+0xd6e/0x12a0 kernel/workqueue.c:2441
  kthread+0x29d/0x330 kernel/kthread.c:376
  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
irq event stamp: 326630
hardirqs last  enabled at (326630): [<ffffffff815474da>] __cancel_work_timer+0x36a/0x560 kernel/workqueue.c:3156
hardirqs last disabled at (326629): [<ffffffff81543e7a>] try_to_grab_pending+0xfa/0x890 kernel/workqueue.c:1267
softirqs last  enabled at (326532): [<ffffffff814f4aab>] __do_softirq kernel/softirq.c:630 [inline]
softirqs last  enabled at (326532): [<ffffffff814f4aab>] invoke_softirq kernel/softirq.c:470 [inline]
softirqs last  enabled at (326532): [<ffffffff814f4aab>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
softirqs last disabled at (326563): [<ffffffff814f4aab>] __do_softirq kernel/softirq.c:630 [inline]
softirqs last disabled at (326563): [<ffffffff814f4aab>] invoke_softirq kernel/softirq.c:470 [inline]
softirqs last disabled at (326563): [<ffffffff814f4aab>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock((work_completion)(&(&host->detect)->work));
  <Interrupt>
    lock((work_completion)(&(&host->detect)->work));

 *** DEADLOCK ***

1 lock held by swapper/0/0:
 #0: ffffc90000007bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974
 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177
 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
 __flush_work+0x122/0xac0 kernel/workqueue.c:3072
 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163
 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:672
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 37 f3 96 f7 e9 44 ff ff ff e8 7d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d 77 23 4a 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6
RAX: bae1574036e3a600 RBX: ffffffff8a3c8957 RCX: bae1574036e3a600
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffffff8c807ec0 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x493/0x53c init/main.c:1112
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
BUG: sleeping function called from invalid context at kernel/workqueue.c:3013
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff8a3b27c9>] schedule_preempt_disabled+0x19/0x20 kernel/sched/core.c:6699
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970
 start_flush_work kernel/workqueue.c:3013 [inline]
 __flush_work+0x142/0xac0 kernel/workqueue.c:3075
 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163
 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:672
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 37 f3 96 f7 e9 44 ff ff ff e8 7d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d 77 23 4a 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6
RAX: bae1574036e3a600 RBX: ffffffff8a3c8957 RCX: bae1574036e3a600
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffffff8c807ec0 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x493/0x53c init/main.c:1112
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
ODEBUG: object ffffc900000079a0 is NOT on stack ffffffff8c800000, but annotated.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:558 debug_object_is_on_stack lib/debugobjects.c:-1 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:558 lookup_object_or_alloc lib/debugobjects.c:591 [inline]
WARNING: CPU: 0 PID: 0 at lib/debugobjects.c:558 __debug_object_init+0x18e/0x440 lib/debugobjects.c:672
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:558 [inline]
RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:591 [inline]
RIP: 0010:__debug_object_init+0x18e/0x440 lib/debugobjects.c:672
Code: 24 04 74 2f 41 ff c6 44 89 35 7e 6a dd 12 48 c7 c1 40 71 df 8a 48 c7 c7 a0 71 df 8a 84 c0 48 0f 45 f9 48 89 de e8 f2 b9 0c 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f
RSP: 0018:ffffc90000007908 EFLAGS: 00010046
RAX: 0000000000000050 RBX: ffffc900000079a0 RCX: bae1574036e3a600
RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000007587 R09: 1ffff92000000eb0
R10: dffffc0000000000 R11: fffff52000000eb1 R12: ffffffff8c8bc760
R13: ffff88805bad4af0 R14: 0000000000000001 R15: ffffffff8a8d3120
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005568d3392430 CR3: 000000007fadd000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __synchronize_srcu+0x227/0x350 kernel/rcu/srcutree.c:1241
 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline]
 wakeup_source_unregister+0x112/0x190 drivers/base/power/wakeup.c:242
 mmc_host_classdev_release+0x43/0xf0 drivers/mmc/core/host.c:77
 device_release+0x92/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x217/0x450 lib/kobject.c:729
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 37 f3 96 f7 e9 44 ff ff ff e8 7d 03 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d 77 23 4a 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807d88 EFLAGS: 000002c6
RAX: bae1574036e3a600 RBX: ffffffff8a3c8957 RCX: bae1574036e3a600
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf68a0
RBP: ffffffff8c807ec0 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fbc
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x493/0x53c init/main.c:1112
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
----------------
Code disassembly (best guess):
   0:	48 89 df             	mov    %rbx,%rdi
   3:	e8 37 f3 96 f7       	call   0xf796f33f
   8:	e9 44 ff ff ff       	jmp    0xffffff51
   d:	e8 7d 03 f6 ff       	call   0xfff6038f
  12:	00 00                	add    %al,(%rax)
  14:	cc                   	int3
  15:	cc                   	int3
  16:	00 00                	add    %al,(%rax)
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	00 00                	add    %al,(%rax)
  1c:	cc                   	int3
  1d:	cc                   	int3
  1e:	00 66 90             	add    %ah,-0x70(%rsi)
  21:	0f 00 2d 77 23 4a 00 	verw   0x4a2377(%rip)        # 0x4a239f
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	0f 1f 40 00          	nopl   0x0(%rax)
  2f:	41 57                	push   %r15
  31:	41 56                	push   %r14
  33:	53                   	push   %rbx
  34:	49 be 00 00 00 00 00 	movabs $0xdffffc0000000000,%r14
  3b:	fc ff df
  3e:	65                   	gs
  3f:	48                   	rex.W