Extracting prog: 7m27.573678527s Minimizing prog: 1h47m46.310263629s Simplifying prog options: 0s Extracting C: 4m16.496499269s Simplifying C: 13m39.328079606s extracting reproducer from 12 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect-openat$dlm_monitor-pipe2$9p-ioctl$NS_GET_PARENT-ioctl$sock_inet6_SIOCSIFDSTADDR-ioctl$SOUND_MIXER_READ_VOLUME detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r4 = ioctl$NS_GET_PARENT(r3, 0x5450, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x541b, &(0x7f00000001c0)={@mcast2}) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d1d, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 12 programs with base timeout 45s testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 23, 12, 10, 20, 27, 12, 23, 14, 20, 3, 12] detailed listing: executing program 1: r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200802, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$KDGETMODE(r1, 0x5450, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x120) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="28000000010201"], 0x28}}, 0x0) (async) recvmsg$unix(r2, &(0x7f0000000f80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000f00)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) (async) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20040825) (async) recvfrom$inet_nvme(r3, &(0x7f0000000200)=""/248, 0xf8, 0x40002001, &(0x7f00000003c0)=@isdn={0x22, 0x1, 0x3, 0x9}, 0x80) (async) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000001dc0)={0x50, 0x0, r5, {0x7, 0x2b, 0x0, 0x2b418842, 0x6}}, 0x50) (async) lsetxattr$trusted_overlay_redirect(&(0x7f0000000100)='./file0/file1\x00', &(0x7f0000000140), 0x0, 0x0, 0x1) (async) syz_fuse_handle_req(r4, &(0x7f0000008e80)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67df181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b94fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922887a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9ecb9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd03063ee145dfc4456bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e621cd12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a0393748622369c107b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff757836aafbbdf1f4440ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb29c80cc69da72f7dc2f2ac730e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52ba9363e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e", 0x2000, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x90, 0x0, 0xffffffffffffffff, {0x5, 0x3, 0x0, 0x4000000000804, 0xfffffffd, 0x6, {0x2, 0x8000000000000000, 0x8, 0x100000000000, 0x2000000000000db4, 0x3, 0x8, 0x6, 0x80000001, 0x1000, 0xe44, r6, r7, 0x40fe, 0x81}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$addseals(r0, 0x409, 0x2) (async) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000e00)={r3, 0xe0, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000b40)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8, &(0x7f0000000b80)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000bc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x9e, &(0x7f0000000c00)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000c40), &(0x7f0000000c80), 0x8, 0x48, 0x8, 0x8, &(0x7f0000000cc0)}}, 0x10) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000e40)={@multicast1, @dev, 0x0}, &(0x7f0000000e80)=0xc) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000ec0)={'ip6tnl0\x00', 0x0}) (async) getpeername$packet(r3, &(0x7f0000000f40)={0x11, 0x0, 0x0}, &(0x7f0000000fc0)=0x14) (async) r13 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r13, 0x8933, &(0x7f0000000280)={'vxcan1\x00', 0x0}) bind$can_j1939(r13, &(0x7f00000004c0)={0x1d, r14, 0x0, {0x2, 0xff}, 0x102}, 0x18) (async) sendmsg$ETHTOOL_MSG_RINGS_GET(r3, &(0x7f0000001280)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001240)={&(0x7f0000000500)=ANY=[@ANYBLOB="34020000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf250f0000006000018014000200626f6e645f736c6176655f30000000001400020076657468315f746f5f6261746164760008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="140002006970766c616e300000000000000000002000018008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468305f6d6163767461700000005c00018008000100", @ANYRES32=0x0, @ANYRES16=r1, @ANYRES32=0x0, @ANYBLOB="080003000000000008000100", @ANYRES32=0x0, @ANYBLOB="080003000100000008000100", @ANYRES32=0x0, @ANYBLOB="44000180140002006c6f00000000000000000080d49ee9d4acfe4184483715904161000000000014000200766574683017619ffcf810eb44ff5ecdac9496921067e32ad5dc9619a164bc424474bf80bbcde203d6f6e2b42abdd8a9162883d0509122a924eede", @ANYRES32=0x0, @ANYBLOB="080003000300000008000100", @ANYRES32=0x0, @ANYBLOB="2000018014000200766c616e31000000000000000000000008000300020000005c00018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="0800030001000000140002006970366772657461703000000000000008000100", @ANYRES32=r10, @ANYBLOB="080003000200000008000100", @ANYRES32=r11, @ANYBLOB="1400020076657468315f766972745f7769666900380001800800030001000000080003000000000008000100", @ANYRES32=0x0, @ANYBLOB="1400020064766d7270310000000000000000000008000100", @ANYRES32=r12, @ANYBLOB="2400018008000300030000000800030000000000080003000000000008000100", @ANYRES32=r14, @ANYBLOB="1c0001800800030003000000080003000300000008000300020000000c0001800800030002000000"], 0x234}, 0x1, 0x0, 0x0, 0x4008091}, 0x90) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) sendmsg$IPVS_CMD_GET_CONFIG(r15, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r16, 0x5450, 0x0) (async) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r8, 0x29, 0x1a, 0x0, 0x68) executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) lseek(r0, 0x3, 0x1) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)) syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xc000d96905a99e0e, 0x56a, 0xb4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x85, 0x60, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x1, 0x7, {0x9, 0x21, 0x3, 0x1, 0x1, {0x22, 0xf6a}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x6, 0x9, 0x4}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x43, 0x5, 0x7}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x201, 0x81, 0x6, 0x3, 0xff, 0x2}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0x2, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x438}}, {0x91, &(0x7f0000000180)=@string={0x91, 0x3, "e2d256bf9dc3db39a91137ea3a2d953cc0cae0a87581daf6cd1879a7dfcb1b9781649ccc084f153f194c1a952da03d567787a953b8cbcfb8739f0b4d1ecd37d10cd33dc529618eaaac821daa540b21472edb59dc4c3817bfdf95087575131e7e99f13673e73790891408c56efa5d64f5a473da37971a61b209effa212d39c9279a0bd12148c1160507fddbc59f9f76"}}]}) ioctl$OCFS2_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000280)={0x1, 0x2, 0x53c3, 0x4, 0x3ff, 0x5}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)={0x7, 0x0, [{0x11117fff, 0x80, &(0x7f00000002c0)=""/128}, {0x26000, 0xb3, &(0x7f0000000340)=""/179}, {0x1000, 0x89, &(0x7f0000000400)=""/137}, {0x100000, 0x1000, &(0x7f00000004c0)=""/4096}, {0xeeee8000, 0x3d, &(0x7f00000014c0)=""/61}, {0xf000, 0xee, &(0x7f0000001500)=""/238}, {0x1117e800, 0x6e, &(0x7f0000001600)=""/110}]}) r1 = geteuid() statx(0xffffffffffffffff, &(0x7f0000001780)='./file0\x00', 0x1000, 0x400, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r1, r2) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3f) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r3, 0x4068aea3, &(0x7f00000018c0)) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000001940), 0x200080, 0x0) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r4, 0x3b65, 0x4) r5 = geteuid() setuid(r5) r6 = add_key$user(&(0x7f0000001980), &(0x7f00000019c0)={'syz', 0x1}, &(0x7f0000001a00)="7183c8c09c18b5720b3c7d50756168f4", 0x10, 0xffffffffffffffff) r7 = add_key(&(0x7f0000001ec0)='pkcs7_test\x00', &(0x7f0000001f00)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$instantiate_iov(0x14, r6, &(0x7f0000001e40)=[{&(0x7f0000001a40)="0745cae98bb61e02b5b9e139ec2a4701e546ed497181bf8c7ebee725ad9f7a41558623306a1836a0778db3e47156c9b21fdf7ae0645d9e4ff7f3ef464171b427f44c20a9f192ebf1bcce6a3efea5d0085e16b6c810", 0x55}, {&(0x7f0000001ac0)="8f3525dd6091489754b89354020ebb9c3f200f23b166757f276e44f9f63ecf2917603fdd6f314efb8064be533c3523a402572dabb3597408b25de028e2b3df0ac409a2814d2a0f755ac79d269e5777e4dfecfbc7d24a41f2179d89ee88be813846a66493fffd18c658167801bc8444a19e5147ca338b0e0aa40deab7dbca2784e683", 0x82}, {&(0x7f0000001b80)="0ad65748262b45c18ee9fea7601f8d5a27a48083", 0x14}, {&(0x7f0000001bc0)="06c23bde1317b11bf59cfd32141c2c525dff1a5cdb31a52fef63b184bafcea3dc3c34e386468c3d1340e5881cb0de1f91b93c980a383c6e400723e19b75e655fcf73cd96cd15a1a42626a42ac072012a37f7abb4b118b0df", 0x58}, {0x0}, {&(0x7f0000001c80)="6d5e3fa5e1072d08f9e06c9b0e9b562a85c91d631357e734518790baa172500c2d2b7cb60a0b1f202d05e6f99bb7823141bdc7e307a4200f9aa2248e99b6daffa7e6ab10211cca23548888e17adbd9630098f2a3abc48586abd74a5cee89ba69a2a3389128ac74f54c4099dd5bc4a313c0a4043079f35995aaad21ccf1d48ba7273aa04c23346150119c6ec31fe2929c505dfb7f951fa90549a7583864bd2eeb758e9d0755f0d97c28b03be58eb0882d8a594a9b1059ca68f7ea2f61ac7cda18197d718089bd1fada13d91aab9b7ac7ff3afc0433576d4a70e340c4c", 0xdc}, {&(0x7f0000001d80)="24685402c72c451b42be20998d5d5c425244d842a69770771dcfe70b4ea28559a2de4ccfb70ea2f4acf2598e9a1b8f4ffc9a5584ec455c48838f1c11d6b3443ccdb839ad8fbadd0a0713cb68f4183fc148001c71bd28bf32136c4daed88c86a93e00abfcc689d7ad7e25506b3564c5", 0x6f}, {&(0x7f0000001e00)="ccc40ca269b41fdce8dc8bef357719830fbba30a2144acf5f0d1409bbdb2d2c9e281a7c277a8f4590a93d5127f69a66bed50b78aed", 0x35}], 0x8, r7) r8 = landlock_create_ruleset(&(0x7f0000001f40)={0x805c, 0xf, 0x1, 0x2012, 0x3, 0x6}, 0x30, 0x2) landlock_restrict_self(r8, 0x4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000002040)={'ip_vti0\x00', &(0x7f0000001f80)={'ip_vti0\x00', 0x0, 0x8, 0x8000, 0x79, 0x4, {{0x1f, 0x4, 0x3, 0x9, 0x7c, 0x65, 0x0, 0x3, 0x2f, 0x0, @private=0xa010102, @local, {[@ssrr={0x89, 0x27, 0xc9, [@remote, @local, @broadcast, @local, @private=0xa010101, @rand_addr=0x64010101, @loopback, @private=0xa010102, @remote]}, @cipso={0x86, 0x1a, 0x9c84f392b7199ded, [{0x5, 0xa, "4f9819ca6c4a4978"}, {0x6, 0xa, "0de612cb82029d71"}]}, @generic={0x81, 0xd, "4290a235cb3f07b0db92d2"}, @end, @ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x71, [@multicast1, @remote, @private=0xa010101, @local]}, @noop, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000002100)={'syztnl2\x00', &(0x7f0000002080)={'syztnl1\x00', r9, 0x2f, 0x1, 0x8, 0xff, 0x20, @private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @remote}, 0x20, 0x8010, 0x3, 0xffffffff}}) fsetxattr$smack_xattr_label(r0, &(0x7f0000002140)='security.SMACK64MMAP\x00', &(0x7f0000002180)={'syz'}, 0x4, 0x1) executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000140)='./file0/../file0\x00', &(0x7f0000002100), 0x10004, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) quotactl$Q_GETQUOTA(0x0, &(0x7f0000000ec0)=@filename='./file0/file0\x00', 0x0, 0x0) syz_fuse_handle_req(r1, &(0x7f0000008140)="d93720db4195e1a34be0ad2f56793935d453c377b35280952f39a19a1c8aacd2cc08dadc1451ecf3ea5602c4fa11e48f06f5c22319277e0ecdb53e2eda975d8b0c0703a4299a9ea93c68dafd02607b4a3fe826919b5010e88399105cacd421aa27d0544308c67ddcc8ff8517d764ffdad87a0dbe21d14a2503d0e96b506de87ea8c0540d52272460cdacaa16211442539f7fe78e5bb111ee23ff07f71a84f64490211f584aebce5979ffc51196826d5688fd197222f5b5b97cff2009a2845c699caa42420e8cea4ea07953369cd8e1f641273236d745f419b4d9922155209b212331da3aa5f73672aa21bb2d574372fa957b3a287d6ebe921bef5b55428bfd6460032889d75a3ee4018353773d52124165020d2eb95dd39e04b2a74886ab6fffd382297d01fb2cb60a978968975d54c66c3912fb40a0e8aa264da07aa9be4f0e01b94446266c4521aa9bbfd034e158a7c7a20a2ba328cc054088bd3f88cc921fecb6e81d83cf43616a7240f76ef1da19cfec4207aa8998417e7dc568719ca154ae9bb38ad2fadddaa995de3a7073c53bcb05a4a13e0ad1d4ffdef949549081819986e07d150e5a000e0fe4d80544732dd3cfe0c9922f4f1773a55c5957e4788eb54d9299456b2c67d353fcd06a8ee6c679013ecbbc9690a22483bd7201c6582d97c1064beadceb37fa5ecbcce3589e1981e0ab13a5a1c9d4433ed3ad5aa23c38e5ec3628c75801d783ac39db125db8d9b6179ec9fa898140c07e30ba85b7e570c5ea1e8cab93586bb5f21918bda1fc4e3966276b736ab987fedca531c81ec0d1b833db24f54751d2d0c28ba9afd26e570cd35a02a4ccdcf9f8ff3a637befb831dee77d4cc084cc17e6eeb813b9c2016672b02e9c6f0364729b0b0c5d821bc4a621a9c95658967c83978042c07a562ca74971bfcdb25109aa90e7c3b8d1ceffd243cfa9cd3bdcb40e3cdadcfcaad0dac169c0187cce25f7de991f6c90ac27ee9bfd2713e88f100b1716f8bd33bd56be5109c20bb36a8f913037bcbe4c3e530d8e87ce0f90f2e0f75d4ece99de86441af8ad7f4f61fcfbcb0f370255e651d99c2f3ba139f6fe73fa43d3084f6930c7f8c436ff5e591d7c117dd7a4b6db5f6ec75484f859ac56e5d721b914b4cc9266ad2797f721f6d2a0ac0c4547136f3959c21f7f13a1cc62a9dc64a9b90afd753b18554cf35c5892b4da6cc12c17ce35ac37cf5b355d325de3b1dd7c4c7777b58e301e33ec1637a99423d1c98e363fbf28c1d4e99c2d2f979cba6f092574a4bad6e231df33a509f74140a3d038fbec7ec9642d618eb8e539f872b3464fb8f79a2975c6744dfa4cf607e2f497f91965c83cf0c77752dd9b4b12876150d916da828640be87402ebd7228518995dc612ed05faa6decbc4ddeae47693ac515f62fc0038ed9942c6f4d9bc4b5f73c4818ee6f08c6b37e8efd647057fbd91e1bdb5b2bc4076fff1b6bcc254d8a6ee92f61a74da856ae11c898a3c44ae364d1d375216a46354055c3c41642e687fca57686b592eb9444e89e420bd2bdd7a76a1113f7c7d77244002b26466d2c7d20a27d67649fb174fe42821c23b1938b5e19fa07292bed86eee6f9ff58bcdf23715cac06fc2f9bfef5085279c1ca0200d8c3e2a6f3e0bb77fa3b1007a0995124b94baf563dc27aa79a65bb589a51481311655ce2aabfec217101bc915cb215f16bb380b233e7535b54aef19abbd1c31fc9e3500dd227caa36377a5ef4d9fb085226c5d3798f6462d616751978753efabe90ad79cdc85fc06f4dfab89002fb7f2fa2189cec8fdc0d6d2a83df9aa2a4fd3f1d11944c2bf49c92f73970acb8a673595f88bab87821a5f05971204fbdc3065a167a6631ffd0cfa5f701d7c0332557b1ba18f20b37478d5bd0e6554b6f73944d6ca3f550dfaace341c437003f079dcc0eaac0f764d16307ade63a2125ba686f5028f2e6972c9875abfda0dc3aa0c2116202d0d66798f2410be640a5553d9400dd8510799963dcc296ec29484b61770e4520d752e04da3dbf60ddcdc6a4976b5ce7356accc79dbd0f48ec114ea4f2cb5d53e7d2a1757f6bc7ca65eeeee3f63f36db72af868c117718f41c428444ff494e857198fccfbe89e8cffa5d587ea59208e47e002f16fd8770d950c5a8ec894927b2105c41aa5e92a68829791c2f8a16a3949da8168f173864a20a389f0b20c446aebea7e0cffaf114182513256de11c8866e0f652d0ec2d8e745c6cf76232dbafa7dc9d5337fa87ae61bbefb2a4b9c90403198bfe1b7035169e97eb2ef7bac31801ee32dc415c06062d0c19c70960377ea2a851b2229d8d306c95106477245d758808a993440834687739543a08484a7e23678f141adce3397ceab56e83cc490a6530cc60c84f721aa342f351b08391e795633cf19b7bfe8dc2233234a96c796584bdaba4c7eedda1277aae5c57eda8acfd046a75604dee4a275a6b6abcd63d54f1abe272703c00d79e1ba85f3464fcd58cbfe0d6f8872e3d99c06456fd80e126b3e9e1dc46b1773dcc9eda7acd7dba6f7d703b08307c75a2b2413f443d7e90c1dbafb0d68bb4dc8353cba5e5bb3d1d527baf9bda6d7a21288e7719ed106633435e3a6a85c743c243f38dc4d2365ce16c5d21aa55a30869c5992a5be2ae13d96b2caff60bca18dd5faa6e329dc3f4e9e029963a6ec0edff0d4f9da8c27d7cc987076d50d9e3d88dd6a18ce4de277d8e73efee3aa97413ae2b7a4ef9875f6ffa04872572b65ba828c42fd23614d22809b5be5a91ac0b96839e5e2346e3cb8d448c93a4d98a07dbf6dce164459deb30518bf4b3272e7e4f499d7b253e486878f3d8d9fa7ad404946e9cbe31bfcf43fce405a5f93588a04c656faa32a05e66a5595ed301dde5a126469f0b679708fe58edd86c2eb6b97a03c0b019eddd7f6d88db1e475021b0879c344018a130233a7ca57c448b263cf802cdc09f965fead4f48ba2d4049c6b88f752f112dbcf8882b26f27b15e5971834ec4ab94c936b15b8f74a38cb96344a445aee1ff02467b6cb4c76df8c4b68523028d7f59d30d4dbe984b989ed1870a59b202072252c306b38a0530780dc031c6015702230e72a90a6a27d97200517293fbb21fe75a01ae3128640d1e03138e2680bec75c0af12ddf95300ba3f126e2f8019ca09a67ea5053f30bf724e5670c17851c537201c8bcb248a5e9849e467b26a2a7b0c6cf6f4690b2e72740591e85b0e7cdeb876390338b8cf74946726a0dd8226718b29d8450e2089cfeb21ff37961afb408c24dac407567ce728607d37e9847a4e82ac84a256d1625d812a1c581fe65e66baa741bed0977c1a728370da67908ea6bec47f5845fd1da0862b4eb94e2b724fcc18732bd1973e92301a33aa022fa7c913a7f43f43f15eef223c7b193c129f861232e4683fa0d86a31db91b4239ff85d14b0fb8b87adbfab7383aabe4748aea807e4c3fe37ce6cd536ad283878598455a9ff7d0baa3f27f7a57fac2f47afdc14b4a334cafb21a8380ad141eeda6f3e069359e98c522c97559a1de5ff7d0f71edc4e433a57dd2d7a035485cf4ad4a55bbdd056dfe03a30bc85c7cf47ba8ed4de220fc056cea68ab77e5cc30f6a2de9abfdbdbd88725b8542b593d81e65945bb0b53bf9815fee368520939ba9fb55588c956d07db9770c6e3b325bd2641cdd1e5201d6910b2ae50feffd28d85ca166cf2949d5a335fd9fd7d77906dbfade2ee6884ae8ca66c39a920ad0a309a8ccb2956306458902116074c4541c85ca4b3e3ba968f17feb17d1a2436424578393ff56b8112635180f0af89db2e33e6935507b025779aea9dbd067edecbd49634ebc77c0d6c4dd4c295dc0e8eb1c44406c64a33ea23c6a93c3a2895fc23cb4f773a29efb05d90beb96479888c55639931e024733a4c32dc576d6e52142b38d8a9b9d2fe312f0159ede1d25df20114b7955c3bb78ecc54add0f357670d031931dbb640f4b57c017e97e71a97c571605125faeca107f8beeb58079b90e6a6cabb1677210c5b2d2659d552fa2daa15faa7b17061abfea725b49dd016a078517c285cf47592bbff7cafa16595884f48e11346b1e4588a083d9dceecd146b3ea0a6b87d049f71b1222ed8864c697e2ccfdb9fc3c7f22187e10a91598e479d25d1546e4fc68dbe56ec94d5bc792e246e817d7769f166104853e405b08b246a2022bda6f9c3f739c6d6d2f3a7f870ee183a76978ec00c43d94aefafe468f0f1021fc74770142db7e5967bae852291ab9c3e56f00a1229b12eea414b8b6fb2c9635f0b5d32175f5be4a04fb572368258a4ed72d4d3494637c8d6ee4c6d4bf35c8c494ac4d2da1864786ad0f41d362d1cf07d60dacd9779c3ef8b8b120b27aab34d9805df829db55e6a691740e118cf542b4f6b28c0d860d4aae677e2702dcfd822fe5457c66dc2f8c457715eede8cac7837a936b731c297927c463b463c1d03d502485b41306dd2063780afe9543f96da9c086fffe3910f2314a382dbbee9f72b7e66e90f44b9049f1059a819ec8ca7af8f836704c6d188e94e7f8bebacc682c4c46de1fde391ab0e5ec89e2a488639e70fc1d9cd5e04c4122903d958d3a03419121e3424a23231289634d010f582c440d87e91286abbe95a86481927f2765f6d0f3c2e9ef60b33ad763035055840c64ada2c841adad19b7d5924a2b86da236f15ee50c0914a0a1cfba62317aa2d33de78d08ab6287618bba0e3fe9496a695f059a475d37c6c937e9dfa77215aa3af6f0a862c23e1c9d15921982e8e17c63a1208b9da06c5f0bc72c4bf855600950cf0ea6e77a91b81e6aebe0e35809464599bf916984ecf8268813a3faee2260c3e28545637e463de165dac512e8b784e5163da5471ee710ffec3c496e78d5c5ec941d2616286960f0a7bbc4d4f778309cf5091ba7e05b7a598d7865ee10e1813515dba5e7b4a3e23c1ba33bec878b0b8f3a13e17b59aa07452fe645069c4e2f7b82f106dc1a6093d45abf393f4a68f57f6521662f639d8136914823c393e0cae4bd3784e6b2bda5671fc8ebc68b3dc7aee2d876a48c205a4e7df8ea786f124f6c83baa8b85df819e8ee366eb5507809a1e36fd3f17facb562dfe511b9183b62852312eaf947fe6a61dc168de4602910c6d12ce15e35e3b4125b5f9714ea1c49a1fdfff7a8ead500b288549b30bf2a1f4f198393432498334e65e198f0352b6c181491859f166e64846570dc551b909d1bf8bc15935ba82183c81c6c49210a347a37db3467c32c7d1e3a8aa3c7957ba2c37eb3f27b928f45908cfd22dab3c604dd053ca2425f122e11fc09cea1344d0e854a28240128e501b4425333dbd5dbba9269d62c516b4d3b16783489c7e25b2816a6f167ffeb6f19a8636b18e15926f5ad1ee4a4dd242a7f1a2fdfc7bfbf40b75da981a566d4965f50657e8179e0d3b40185f29a5061ea351e60970cb3d142c28375a5d8dced003a5b01846b4ed6460acdf2cbde7529da68aecd562d3ae10aa1c1e2325f09884df99e0f4246b2f9b879d711ab49757910c54f8fa48439dd47ce70935cd4f3b1ff85a28232b6ccbb51fd5d36a69c4eb5abf9cef8642172399f94cb2daed8d2d6ed279c6e35284e7ac5db840ca12ed7d168454725e19f552aad7de59ab368e4d42238444a8672f937aedc61c2159b6d1d4aada07c6de08ae40a1bae8ca696273f5748a6259ff4bcc39510e11a5f8ba25766c6779f07761c936ac0d0d01f1d4b488c3d2742c1a3029da837cc33dd1780695c5fc1542830006989b3faa62a9c8538ae840c8285cde8a13085cd295f695a0ab6d27b03a16b1904fc62fe25776df3fa792f54f4a5ad98f1f0be45848c81e34d70d4850a4ac3a5a7dbc56fff68eb4212bb1109f6f129c12babef6ef9671901c73da50966fb18d1f0c1575cbf985fd5a5c36f33386a1ce35c2ca4422b3c0522fbcbd873d8f0f80734b4f3e0bd1aa80beb6b1ec9a40a2d39adac14b7de089820c1314ef3b2fc2988778b9cbca0fe0f64cb858a90a6bcf67961644f6bd5825c43c9d4d4b0a8e5c7321346edf5f56558c00550891392055e15a6402220301235ac8593dbbe26f1f5105d50b1199d2fe2d74a78ea8e83fb409716c7d508ac1476d067c5aa77b1f689488e406bb6702648aa1faeecdcce8702f3d66e66c927487cfba756c070065126f225afc58fe54d50923f1c7b14ce478d40f4bf9eccc441c8c931359f97898e6d8fe42a175546ec8c6d52672947e0233c1cccad78d44494361f6c81c530e9bea0e911d30998f0aeddeda8269e1a87e86509a5a4c2ed5f49e8b1bfdae1cfda352dee261ea029f80418e2232616e9f8443fce5d3f82e6bc8b8fc1e65419dc2fd1451e445f6e06ea3d12206ecadf4e45f9bf1340e162be57ea63787580c50a452af6d3b12fe4e2b8aa861e435f7766f35fa272841094149c81a40e7bff1f7177c38787b53b1b4fcf18e50c89ad3049f35f30900628d4bdbacc07c44f8fc0006023407b4484ad6fbc15094b02a009f50e34efc0e75ab23dcc1b8355f4cd5f693aaf01e6fde20ce36fbd7fac42e00ce6100b0dfa974680dfef60ffa7f905840a2c345410abc5907edbd18d01556e6ce2593c910b282be64b225e6ce5b9b2388d602023959680981f0ee1296ecdf08e57c6a797421997a022e869f8e8a48a91a1bbe30169f608a2e854bd4de33adf2fe67577de2feee46424a679f7666307ab2134bbe9e79a12af724f97dda27d075e00cd59a260ca33be676df34ee96e13d436395edbafe4a83e1246b7b0194bd4c40d74521e52f06572102ecddd71da2bc35057eb66e7278801512f349d9f798ac8c38ba4fd2523d9f2f9586749b64dc8a0e3461cd7b7fb82e575bbba20c359ca2076cd669cb1ef83f082f21868c31fd750a2dac5670317c550a79324db88b68dd0f16e98c4b83710024d059569f5402eae23e8052b5b4b48502e0fc2483a20e38417f57cdb7ae870ce3c8352b1f4c6ffd61ed8e2751f5b93e266617b087c94a68ef704731409f3fd49bf677bdcc0c58e6094a8fd99cce1df278570390c37f51faf6fe93923f62984d5672a2d867f18ca76b964e2f7c259f639ab1122e749dd9c4f9b4470d8b68502f6f40685b74a24323837cf7e32b433c3ccbf064be0e70ffc2e5c2eae587154a7958d6c3f696fe42da49e4292404461908f7a1437b000a7f115cba487a9b426aa6ebdecbf0673e39356f894c0b3417491d0dd266a97b8711d16e6ed053028995e414d602f3296542ed46591c44a5dd1c466a92d8826bc12973e44028d37fb13bbe9ed2947334787c60f48b4f61089e3425fd165eaa1e3a2707891732875018420060afa179687c9e0f3f43b45e81fff95e07a518c9db494d0e4e453b8a35c7a0dd1ae81f4c0fd49f40fc9a6165a01ec00e0a97cd7282fb0c264709fa6e8310372bf06f66fd0f53d7919cba43d59cfcbb9f3b148b73edbdd75acdfe5f5fe2ffe40416c097e18a0fc0619bfbb78066f372d21f5d52fe4753ab29a0edf66b05c5bd3e6a5190f248561919dea3f20185e89f79fea4aaa12a44f14041a0620b23f28d5c535f40bae130843125a879e7f33d6c61cbe55ba51837b3194245237317d8532f94ed06543f5cc55535045b8b514c0d76097f520387e7b182c48c7b0173ac353d48566fafa00e7e5f7962f79645f73150d1921b6d6bcd240898aedb21b4453d63ba838bf90efbc5363beae5ad0609469a5b1c51aeae051fa57b16ad7f7c7a3f018e292ca5fbd9be583cfa9babbbb21caa574d35d8d778b1ae56e627ace9121fe5de64ed6dc684e5ee65c85baf2237953a0ced94eaa01e8c1911f487fb8324089f687040aac05dbb39475b26b1549c3d0a6b2d701fabd478b0d2e22cf720a6c80dc8971b1f0a9f39b4732fc7923a23b736966ee1537199511018723632631d36f6eca17c1192b6ec5cd68fd0de31c256270d668db457bbf57de66cb5054f446cdba23440cf485c5b379639284fb653141e20f8ab14c43f1faa181feae3a09cc6654ccc76e901c9c2fa67eeb17f488db52cde8cd26fba1f20db19c1dd92d9b09d1d2e9c8383aca4029492e5b91039fe624b35212c068120cd33a40b3ee7369bed5a705e0f7b13f0f266ff985a535d99c0a99366ab9767254da39964cd1a5df670bb7cebc06a5054d8a63aa5472f4a1d381cfc3d0e0ca8ee8c6f06974facc76538f6eaad66fc673f2dcc5cc65309fa7c821045813a1cf30d6b0a7e83e65b78f47957f28a7a80f34a14754b3347cd16e1b4d2a596099d1a17c681be6d9e4aa3724ea8a6fd6cf1a7492bedca5b47d22f1fbd710a77146acf6a11b95b36eeb2dd15c76ce7a54817c4181c90799ded1cf8c1168b39f5338822f485fc258ca42e1474927f6fb4ebf46bde59fe4e0b216fcb4015c40af76da02ef309039bc9fad472d5e9088b1f47b4a03e50458392a9d1cf4612690289429bbb60be45d9b658d1e88c2df6383c766b6246760238ff968f344311f6d9c3619763c573b7f27b99cdff92d6090003164ca5e68cc60690fb13118f46424e98592b37755d715416c7fc758881f29f87371d086d24c759eb4455b50eff93123b5b150186e5a9e20945d0833a7d1039712736f5b266a7041a2ea20e959ed0a5286352f9a5f96b5b72df30df35c693379304d02200052b491a1dc18239ad5b953ae70c0f33623de25256cbf637bf25e24b21d4c78ba4591481e8424f1a1f329958c5f3ec3cc8ee72a6950dc2c1cfdf2354143e285ca9f82bec1fdf51ccab28ee51035c8dbcef7170843e858d01360266860800571a4fe0936ba82b97c8fcf76f19d49f6f95bc37b23997f8153c22b49d43598af71797547e02050f24fdaa4defe4513aab82f18e2223e2372cfaa95ec24fac636025bfdba5a4fbe25bb4beb596d272d06bc5c19e88e323d4c3afac75ded11b05cf3a0aef570e2700fad7d4b714cc8db83ed5a1c8d398d37bf1a3686ff122b76f06f4ece5413c5da26944e31177e5088e5b4255ff0cd2358b997f511bbc6593b3a6d14b3411a3a22a4e1751c3d0459fadbeae6f0bc399c7e526ba309708fc374e4c3dffbf03355b5147794704a71d6714e2329523dcfbdd6137c87212bc13d9b83d00b11422ba73abee769374762df22f55efde6766ca37c351a07552255a42aba6b9aab9ccb8576da44a7341797af0d86b68d3ab17821e86405e34e49cb73198b78b2536d49f5590ba2cc75ba9d0cb7b7f7c13bce023301a84b67d1afddad8bd1904803f9a4392ae7742bfb35530f0da566a295ba5a0786db745bd4ad5de86120fbc0b453131b4f21bd519aefe216cd7658d80e3a6afdf0f8c28ce0d138a38f0ffb5d7dac8692808be0299423253b91a347aabdf60db0a5c35404ee414b031ae75e0095b8f07e6471be0c19fb41591cb290342a04ad89f17b3d00af14a0763a71ae376c9f707ee7cf3254e42d2641239d531e7e1c94805df8bc58a8075ce535cc648da9a3e0a9decf6d699173b1f65d25e366b0c8701eb53e0b509ca077bfd142f5a1b2782838bbafcfffb0b8c0d6751de09f68d0b23834ea46370568c9a4fb7630fc1e82dffc56da06090ce3d61aa1dd5807a98dc6aac17518a0cebb0bd0ff4d828743fa9ff0381e730df6c6b0137667a0875f1c4d8c820b0ae44253a5e3047f4a64bbcc64dcb1035b43c2c63a97df5a8cbf3be7ec92ac92e3d8ab7f257ab63eefde2ffe5abbf040d3776bef144c5e372f044fafdaba0540368615c92dfb61a3ff45651835bbd6610f4f6e5b7875d9c74367e913fb2dca9f6c755a070d01a600633f399af71d99aef87871ebdd8c0a27dbbab4961ca83df205c9440658ad3192dc116281e26eb6f236fd701667d5dae9f1c48e66c7396366b48f2557dcfd30ca4a96a7daf292c3a6b3278d910a728bcc39e66dec14969b1742d960307c45bb38fdec8f9c26775cbc7ec671873f4af31eaf9339de30b60fc3613724de2171ae81d86949c534f169b8ee5fe8318a2ec64e3b690da09e0c355225c8205c6adacde1f25c242aa1b456d6b23f0bda02b369bb0c751623fe4d40c6e6999d9e494423481ce01c85dd45ae4f6f6993388bdd32bdf01b9c22215c644ba8b517498ca02dee7f32fde3d8f591896c21cb68c82b90d84694ffbf2fcc875abce3ecbc33d9a6c58807cb0c2f3a5f77f107653c1dca780ee861799498e8165c2be957ba9f6c8bf57549674b389d341e2b99fc7931ea40793d9a17604298220af7254eb8e972cd28ea877d8ed52bab1162de7a66a0e9afd10e649b5554f41df0a7623c3e1744f439f39685de6afc65dd6c37069681afd30e476c09142c8460191526ddde6c651767ac59371a881f757d3cf2bae6d48ea781e89931b9e3ea3f65097b006fe15b61cbefede125e949abf541d670f122eff8be716b2cd662d69ead1dc797d58efe39a6c674233610452746cff38d63b8eb217b4fc66de320aebac6e02e149f197b1ab53544162c22597ad7499f7bd75d0307ce75ce5f3b606b009c7dae85615bccaadb3cf261549be0cfe29e8faa175403342384b3efb79ecbdd4350ac768ab6d40957dd185fc4509938f9d387c86c06ed93baf9b4f931f53ded6aa431531a64a39e4fbe92b25d2c28f9314a5570b72ec33a0080d3ab68bc9fcb1786ccd5876856fa1310480f8272ee931679195e19ba116ccfe4b82c928698fe6b96b03d5f33b332bf2fb9fdfb82e386a716853d35a4374f092c2ab00e43fb8639fc525a87d41548e2289074345ca780e29c871c1ae27d27abb25dc9f5cc7460fedea216fd36ee28f69b00f7535dbf931d638f4ed710720cd94de10938ac2018888df4d1aee5676d09e4999b92d48a579916d86faebdefb9562e32e4a43857ab90af69ebd6b22ae50a1a99f8f0ffc731b2db79889824b587b75043265fa1dca7b68c2c2df36b774b5103a149bcfd4d1b3cbce3e4f257f981f973693a8120c4d4d1aefad1451c24dc12fdf798c23786c7498c6faa2b46057bd4d4be51d219a373a6153711a490c588c2085befdaa31c17cc1efc08e341e065e27489ec987a994aceffc0d3ed764606e2195bf3553fbab72a0583396f49743c7059371a3083a4fe7dcc553e26a871503990a9b99539ff0cf90866b90b6180465756c3f5c9387aa83854c8b5335fd6a71b32383c34f22241cd25d538989d19ec7052a41523d7bdd8a834315dab3c27d9b92274fb9148119d458b38eba62d8cf955a326437f7d13ff61142748410a2fbba9341f58ddfdd45cfd77106b1ec6bae9666537705bd79e645f7a735f07865e603ed2583936a4c92377ba099fd6de8cf29b1761846a6bb803fb6ad1830e6d72beb73d89956ceaab9c2e711ac22e5823e341e14d33093d382344f811c105e7e0e0a8d73602edb2e9860235cf5e65a7c4f91d85f8038ea6706f68688576bfb75b4832fad45e4d31a3832e56b83cdacb09f10097028de8931d155b6b68adae12d7c3fb030b9436697ce648d33d0c6ce9d281e11d4c126634f50693b5edee21526b96f69f565668b7cb811151a2d27f44cca69bc36edab2cdf09de88d53246c5bcfd91c2a409f98075e64ff2d716701e28b30f5e3e2834f8cce5b8", 0x2000, &(0x7f00000008c0)={&(0x7f00000000c0)={0x50, 0x0, 0x7983, {0x7, 0x2b, 0x2, 0x96c090f, 0x2, 0x4f91, 0x4fb, 0x1, 0x0, 0x0, 0x4, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) r2 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) r3 = dup3(r2, r0, 0x80000) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, 0x0) executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x288040, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x8903, &(0x7f0000000280)={0x1, 0x0, 0x1000, 0xfffffffffffffed1, 0x0, 0x60, 0x0, 0x0}) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) fcntl$setsig(r2, 0xa, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x6, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x200000c0) executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = dup3(r1, r0, 0x0) sendmsg$DEVLINK_CMD_PORT_SPLIT(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000740)={0x1d, r3, 0x2}, 0x18) r4 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000280)) sendmsg$NL80211_CMD_DEAUTHENTICATE(0xffffffffffffffff, 0x0, 0x2400c805) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0xa05a85be5f3e09b9, 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000240), 0x7ff, 0x240) close_range(r6, r5, 0x0) r7 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r7, 0x100, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void, @val={0xc, 0x99, {0x400, 0x6d}}}}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x40001) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r9 = fcntl$dupfd(r8, 0x0, r8) write$smackfs_label(r9, &(0x7f0000000200)={'/dev/vcsa\x00'}, 0xb) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(0xffffffffffffffff, 0x5450, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x1406, 0x100, 0x70bd2a, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x810) executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x200002, 0x0) close(r2) socket$nl_netfilter(0x10, 0x3, 0xc) write$FUSE_ENTRY(r2, &(0x7f0000002600)={0x90, 0x0, 0x0, {0xffffffffffffffff, 0xffffffffffffffff, 0x72, 0x1, 0x10001, 0x2, {0x6, 0x6, 0x97, 0xf89, 0x2, 0x6d2ad328, 0xc, 0x5, 0x7a, 0x2000, 0x1, 0x0, 0x0, 0x9, 0x3}}}, 0x90) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) r5 = dup3(r1, r0, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) close(r9) r10 = socket(0x1d, 0x2, 0x6) r11 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r11, 0x8982, &(0x7f0000000080)={0x2, 'vlan0\x00', {0x6}, 0x1aff}) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) bind$can_j1939(r10, &(0x7f0000000380)={0x1d, r12, 0x2, {0x1}, 0xfd}, 0x18) sendmsg$IPCTNL_MSG_EXP_GET(r10, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000006c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4) sendmsg$TIPC_NL_LINK_SET(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x29c}, 0x1, 0x0, 0x0, 0x44811}, 0x48001) ioctl$TIOCMBIS(r8, 0x5452, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x124, r6, 0x500, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0xf}}}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x81, 0x28}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xc1, 0x65}}, @NL80211_ATTR_MESH_CONFIG={0x3c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x9}, @NL80211_MESHCONF_FORWARDING={0x5}, @NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME={0x6, 0xd, 0x8}, @NL80211_MESHCONF_FORWARDING={0x5}, @NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0x89}, @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT={0x8, 0x17, 0xfff}, @NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0x5e}]}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x58}, @NL80211_ATTR_MESH_CONFIG={0x34, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xd9}, @NL80211_MESHCONF_HWMP_RANN_INTERVAL={0x6, 0x10, 0x4}, @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT={0x6, 0xa, 0x45}, @NL80211_MESHCONF_HWMP_ROOTMODE={0x5, 0xe, 0x1}, @NL80211_MESHCONF_AWAKE_WINDOW={0x6, 0x1b, 0x4d}, @NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL={0x6, 0x19, 0x5}]}, @NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL={0x6, 0x19, 0xf984}, @NL80211_MESHCONF_HT_OPMODE={0x6}]}, @NL80211_ATTR_MESH_CONFIG={0x1c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT={0x6, 0xa, 0x6}, @NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x7}, @NL80211_MESHCONF_HWMP_ROOT_INTERVAL={0x6, 0x18, 0x13d4}]}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r13}, @NL80211_ATTR_MESH_CONFIG={0x34, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_CONFIRM_TIMEOUT={0x6, 0x2, 0xe1}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x4}, @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL={0x6, 0xc, 0xff93}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0x5}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0xa}, @NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0x9}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x90}, 0xc4) accept4(r5, 0x0, 0x0, 0x80800) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) read$char_usb(r0, 0x0, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$BTRFS_IOC_RESIZE(r1, 0x540b, 0x0) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x4900, 0x0) write$USERIO_CMD_REGISTER(r2, &(0x7f0000000040)={0x0, 0x6}, 0x2) socket$netlink(0x10, 0x3, 0x0) (async) read$char_usb(r0, 0x0, 0x0) (async) syz_open_dev$ttys(0xc, 0x2, 0x0) (async) ioctl$BTRFS_IOC_RESIZE(r1, 0x540b, 0x0) (async) openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x4900, 0x0) (async) write$USERIO_CMD_REGISTER(r2, &(0x7f0000000040)={0x0, 0x6}, 0x2) (async) executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) lseek(r0, 0x3, 0x1) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)) syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xc000d96905a99e0e, 0x56a, 0xb4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x85, 0x60, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x1, 0x7, {0x9, 0x21, 0x3, 0x1, 0x1, {0x22, 0xf6a}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x6, 0x9, 0x4}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x43, 0x5, 0x7}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x201, 0x81, 0x6, 0x3, 0xff, 0x2}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0x2, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x438}}, {0x91, &(0x7f0000000180)=@string={0x91, 0x3, "e2d256bf9dc3db39a91137ea3a2d953cc0cae0a87581daf6cd1879a7dfcb1b9781649ccc084f153f194c1a952da03d567787a953b8cbcfb8739f0b4d1ecd37d10cd33dc529618eaaac821daa540b21472edb59dc4c3817bfdf95087575131e7e99f13673e73790891408c56efa5d64f5a473da37971a61b209effa212d39c9279a0bd12148c1160507fddbc59f9f76"}}]}) ioctl$OCFS2_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000280)={0x1, 0x2, 0x53c3, 0x4, 0x3ff, 0x5}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)={0x7, 0x0, [{0x11117fff, 0x80, &(0x7f00000002c0)=""/128}, {0x26000, 0xb3, &(0x7f0000000340)=""/179}, {0x1000, 0x89, &(0x7f0000000400)=""/137}, {0x100000, 0x1000, &(0x7f00000004c0)=""/4096}, {0xeeee8000, 0x3d, &(0x7f00000014c0)=""/61}, {0xf000, 0xee, &(0x7f0000001500)=""/238}, {0x1117e800, 0x6e, &(0x7f0000001600)=""/110}]}) r1 = geteuid() statx(0xffffffffffffffff, &(0x7f0000001780)='./file0\x00', 0x1000, 0x400, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r1, r2) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3f) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r3, 0x4068aea3, &(0x7f00000018c0)) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000001940), 0x200080, 0x0) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r4, 0x3b65, 0x4) r5 = geteuid() setuid(r5) r6 = add_key$user(&(0x7f0000001980), &(0x7f00000019c0)={'syz', 0x1}, &(0x7f0000001a00)="7183c8c09c18b5720b3c7d50756168f4", 0x10, 0xffffffffffffffff) r7 = add_key(&(0x7f0000001ec0)='pkcs7_test\x00', &(0x7f0000001f00)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$instantiate_iov(0x14, r6, &(0x7f0000001e40)=[{&(0x7f0000001a40)="0745cae98bb61e02b5b9e139ec2a4701e546ed497181bf8c7ebee725ad9f7a41558623306a1836a0778db3e47156c9b21fdf7ae0645d9e4ff7f3ef464171b427f44c20a9f192ebf1bcce6a3efea5d0085e16b6c810", 0x55}, {&(0x7f0000001ac0)="8f3525dd6091489754b89354020ebb9c3f200f23b166757f276e44f9f63ecf2917603fdd6f314efb8064be533c3523a402572dabb3597408b25de028e2b3df0ac409a2814d2a0f755ac79d269e5777e4dfecfbc7d24a41f2179d89ee88be813846a66493fffd18c658167801bc8444a19e5147ca338b0e0aa40deab7dbca2784e683", 0x82}, {&(0x7f0000001b80)="0ad65748262b45c18ee9fea7601f8d5a27a48083", 0x14}, {&(0x7f0000001bc0)="06c23bde1317b11bf59cfd32141c2c525dff1a5cdb31a52fef63b184bafcea3dc3c34e386468c3d1340e5881cb0de1f91b93c980a383c6e400723e19b75e655fcf73cd96cd15a1a42626a42ac072012a37f7abb4b118b0df", 0x58}, {&(0x7f0000001c40)}, {&(0x7f0000001c80)="6d5e3fa5e1072d08f9e06c9b0e9b562a85c91d631357e734518790baa172500c2d2b7cb60a0b1f202d05e6f99bb7823141bdc7e307a4200f9aa2248e99b6daffa7e6ab10211cca23548888e17adbd9630098f2a3abc48586abd74a5cee89ba69a2a3389128ac74f54c4099dd5bc4a313c0a4043079f35995aaad21ccf1d48ba7273aa04c23346150119c6ec31fe2929c505dfb7f951fa90549a7583864bd2eeb758e9d0755f0d97c28b03be58eb0882d8a594a9b1059ca68f7ea2f61ac7cda18197d718089bd1fada13d91aab9b7ac7ff3afc0433576d4a70e340c4c", 0xdc}, {&(0x7f0000001d80)="24685402c72c451b42be20998d5d5c425244d842a69770771dcfe70b4ea28559a2de4ccfb70ea2f4acf2598e9a1b8f4ffc9a5584ec455c48838f1c11d6b3443ccdb839ad8fbadd0a0713cb68f4183fc148001c71bd28bf32136c4daed88c86a93e00abfcc689d7ad7e25506b3564c5", 0x6f}, {&(0x7f0000001e00)="ccc40ca269b41fdce8dc8bef357719830fbba30a2144acf5f0d1409bbdb2d2c9e281a7c277a8f4590a93d5127f69a66bed50b78aed", 0x35}], 0x8, r7) r8 = landlock_create_ruleset(&(0x7f0000001f40)={0x805c, 0xf, 0x1, 0x2012, 0x3, 0x6}, 0x30, 0x2) landlock_restrict_self(r8, 0x4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000002040)={'ip_vti0\x00', &(0x7f0000001f80)={'ip_vti0\x00', 0x0, 0x8, 0x8000, 0x79, 0x4, {{0x1f, 0x4, 0x3, 0x9, 0x7c, 0x65, 0x0, 0x3, 0x2f, 0x0, @private=0xa010102, @local, {[@ssrr={0x89, 0x27, 0xc9, [@remote, @local, @broadcast, @local, @private=0xa010101, @rand_addr=0x64010101, @loopback, @private=0xa010102, @remote]}, @cipso={0x86, 0x1a, 0x9c84f392b7199ded, [{0x5, 0xa, "4f9819ca6c4a4978"}, {0x6, 0xa, "0de612cb82029d71"}]}, @generic={0x81, 0xd, "4290a235cb3f07b0db92d2"}, @end, @ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x71, [@multicast1, @remote, @private=0xa010101, @local]}, @noop, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000002100)={'syztnl2\x00', &(0x7f0000002080)={'syztnl1\x00', r9, 0x2f, 0x1, 0x8, 0xff, 0x20, @private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @remote}, 0x20, 0x8010, 0x3, 0xffffffff}}) fsetxattr$smack_xattr_label(r0, &(0x7f0000002140)='security.SMACK64MMAP\x00', &(0x7f0000002180)={'syz'}, 0x4, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r4 = ioctl$NS_GET_PARENT(r3, 0x5450, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x541b, &(0x7f00000001c0)={@mcast2}) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d1d, 0x0) executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = dup3(r1, r0, 0x0) sendmsg$DEVLINK_CMD_PORT_SPLIT(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000740)={0x1d, r3, 0x2}, 0x18) r4 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000280)) sendmsg$NL80211_CMD_DEAUTHENTICATE(0xffffffffffffffff, 0x0, 0x2400c805) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0xa05a85be5f3e09b9, 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000240), 0x7ff, 0x240) close_range(r6, r5, 0x0) r7 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r7, 0x100, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void, @val={0xc, 0x99, {0x400, 0x6d}}}}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x40001) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r9 = fcntl$dupfd(r8, 0x0, r8) write$smackfs_label(r9, &(0x7f0000000200)={'/dev/vcsa\x00'}, 0xb) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(0xffffffffffffffff, 0x5450, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x1406, 0x100, 0x70bd2a, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x810) executing program 0: socketpair(0x1, 0x6, 0x0, &(0x7f0000001400)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$inet_nvme(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x40000020) (async, rerun: 64) write$P9_RFLUSH(r0, 0x0, 0x0) (rerun: 64) executing program 0: r0 = memfd_create(&(0x7f0000000280)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x3) fcntl$addseals(r0, 0x409, 0x7) ftruncate(r0, 0x10000) r1 = socket$alg(0x26, 0x5, 0x0) r2 = dup(r1) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x44242, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r3, 0x80045113, &(0x7f00000000c0)) r4 = accept(r2, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r5, 0x5450, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect-openat$dlm_monitor-pipe2$9p-ioctl$NS_GET_PARENT-ioctl$sock_inet6_SIOCSIFDSTADDR-ioctl$SOUND_MIXER_READ_VOLUME detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r4 = ioctl$NS_GET_PARENT(r3, 0x5450, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x541b, &(0x7f00000001c0)={@mcast2}) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d1d, 0x0) program crashed: KASAN: slab-use-after-free Write in do_bad_area single: successfully extracted reproducer found reproducer with 14 syscalls minimizing guilty program testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect-openat$dlm_monitor-pipe2$9p-ioctl$NS_GET_PARENT-ioctl$sock_inet6_SIOCSIFDSTADDR detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r3 = ioctl$NS_GET_PARENT(r2, 0x5450, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x541b, &(0x7f00000001c0)={@mcast2}) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect-openat$dlm_monitor-pipe2$9p-ioctl$NS_GET_PARENT detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) ioctl$NS_GET_PARENT(r2, 0x5450, 0x0) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect-openat$dlm_monitor-pipe2$9p detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2$9p(&(0x7f0000000100), 0x0) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect-openat$dlm_monitor detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat-mprotect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL-symlinkat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) symlinkat(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_DEL detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14}, 0x14}}, 0x800) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-socket$nl_netfilter detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) socket$nl_netfilter(0x10, 0x3, 0xc) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat detailed listing: executing program 0: mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program did not crash testing program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, 0x0, 0x802, 0x104) program did not crash extracting C reproducer testing compiled C program (duration=6m43.405716595s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program crashed: KASAN: slab-use-after-free Write in do_bad_area simplifying C reproducer testing compiled C program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program crashed: KASAN: slab-use-after-free Write in do_bad_area testing compiled C program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program did not crash testing compiled C program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program crashed: KASAN: slab-use-after-free Write in do_bad_area testing compiled C program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program crashed: KASAN: slab-use-after-free Write in do_bad_area testing compiled C program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program crashed: KASAN: slab-use-after-free Write in do_bad_area testing compiled C program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat program crashed: KASAN: slab-use-after-free Write in do_bad_area testing program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program crashed: KASAN: slab-use-after-free Write in do_bad_area validation run: crashed=true testing program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program crashed: KASAN: slab-use-after-free Write in do_bad_area validation run: crashed=true testing program (duration=6m43.405716595s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) program crashed: KASAN: slab-use-after-free Write in do_bad_area validation run: crashed=true reproducing took 2h20m14.779467946s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __lse__cmpxchg_case_acq_64 arch/arm64/include/asm/atomic_lse.h:272 [inline] BUG: KASAN: slab-use-after-free in __cmpxchg_case_acq_64 arch/arm64/include/asm/cmpxchg.h:122 [inline] BUG: KASAN: slab-use-after-free in __cmpxchg_acq arch/arm64/include/asm/cmpxchg.h:170 [inline] BUG: KASAN: slab-use-after-free in raw_atomic64_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4181 [inline] BUG: KASAN: slab-use-after-free in raw_atomic64_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4299 [inline] BUG: KASAN: slab-use-after-free in raw_atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-long.h:1482 [inline] BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4458 [inline] BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible+0x10/0x70 kernel/locking/mutex.c:1109 Write at addr faf0000016813780 by task syz.3.150/3858 Pointer tag: [fa], memory tag: [fe] CPU: 0 UID: 0 PID: 3858 Comm: syz.3.150 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C) show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x1c4/0x4b0 mm/kasan/report.c:482 kasan_report+0x84/0xac mm/kasan/report.c:595 report_tag_fault arch/arm64/mm/fault.c:368 [inline] do_tag_recovery arch/arm64/mm/fault.c:380 [inline] __do_kernel_fault+0x1b4/0x220 arch/arm64/mm/fault.c:424 do_bad_area+0x68/0x80 arch/arm64/mm/fault.c:529 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:909 do_mem_abort+0x40/0x90 arch/arm64/mm/fault.c:985 el1_abort+0x44/0x64 arch/arm64/kernel/entry-common.c:342 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:469 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:585 __lse__cmpxchg_case_acq_64 arch/arm64/include/asm/atomic_lse.h:272 [inline] (P) __cmpxchg_case_acq_64 arch/arm64/include/asm/cmpxchg.h:122 [inline] (P) __cmpxchg_acq arch/arm64/include/asm/cmpxchg.h:170 [inline] (P) raw_atomic64_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4181 [inline] (P) raw_atomic64_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4299 [inline] (P) raw_atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-long.h:1482 [inline] (P) atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4458 [inline] (P) __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] (P) mutex_lock_interruptible+0x10/0x70 kernel/locking/mutex.c:1109 (P) do_dentry_open+0x128/0x4fc fs/open.c:996 vfs_open+0x2c/0xe8 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x5b4/0x960 fs/namei.c:5000 do_file_open+0xb0/0x168 fs/namei.c:5029 do_sys_openat2+0x84/0x104 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __arm64_sys_openat+0x64/0xc0 fs/open.c:1434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 Allocated by task 3857: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 save_stack_info+0x40/0x160 mm/kasan/tags.c:106 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] poison_kmalloc_redzone mm/kasan/common.c:371 [inline] __kasan_kmalloc+0xf8/0x120 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x1d0/0x470 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1610 [inline] gadgetfs_bind+0xd0/0x3c0 drivers/usb/gadget/legacy/inode.c:1701 gadget_bind_driver+0x90/0x284 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0xbc/0x2bc drivers/base/dd.c:706 __driver_probe_device+0x11c/0x184 drivers/base/dd.c:868 driver_probe_device+0x3c/0x114 drivers/base/dd.c:898 __driver_attach+0x90/0x180 drivers/base/dd.c:1292 bus_for_each_dev+0x7c/0xdc drivers/base/bus.c:383 driver_attach+0x24/0x30 drivers/base/dd.c:1310 bus_add_driver+0xe4/0x208 drivers/base/bus.c:763 driver_register+0x68/0x130 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x54/0xfc drivers/usb/gadget/udc/core.c:1752 dev_config+0x214/0x484 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0xd4/0x36c fs/read_write.c:685 ksys_write+0x70/0x108 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x18/0x24 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 Freed by task 3857: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 save_stack_info+0x40/0x160 mm/kasan/tags.c:106 kasan_save_free_info+0x18/0x40 mm/kasan/tags.c:147 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0xe8/0x160 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x150/0x420 mm/slub.c:6792 put_ep.part.0+0x44/0x60 drivers/usb/gadget/legacy/inode.c:225 put_ep include/linux/refcount.h:396 [inline] destroy_ep_files+0x104/0x170 drivers/usb/gadget/legacy/inode.c:1591 gadgetfs_unbind+0x7c/0xc0 drivers/usb/gadget/legacy/inode.c:1664 gadget_unbind_driver+0x7c/0x118 drivers/usb/gadget/udc/core.c:1724 device_remove+0x4c/0x80 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x1cc/0x224 drivers/base/dd.c:1372 driver_detach+0x4c/0xb0 drivers/base/dd.c:1435 bus_remove_driver+0x6c/0xbc drivers/base/bus.c:832 driver_unregister+0x30/0x60 drivers/base/driver.c:202 usb_gadget_unregister_driver+0x20/0x40 drivers/usb/gadget/udc/core.c:1784 dev_release+0x68/0x80 drivers/usb/gadget/legacy/inode.c:1207 __fput+0xcc/0x2f8 fs/file_table.c:512 ____fput+0x14/0x20 fs/file_table.c:540 task_work_run+0x70/0xe0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x168/0x19c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x1f0/0x1fc arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 The buggy address belongs to the object at fff0000016813780 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of 192-byte region [fff0000016813780, fff0000016813840) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56813 flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: f5(slab) raw: 01ffc00000000000 f0f0000003401300 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000150015 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: fff0000016813500: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fff0000016813600: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >fff0000016813700: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ fff0000016813800: fe fe fe fe f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 fe fff0000016813900: fb fb fb fb fb fb fb fb fb fb fb fe fe fe fe fe ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __lse__cmpxchg_case_acq_64 arch/arm64/include/asm/atomic_lse.h:272 [inline] BUG: KASAN: slab-use-after-free in __cmpxchg_case_acq_64 arch/arm64/include/asm/cmpxchg.h:122 [inline] BUG: KASAN: slab-use-after-free in __cmpxchg_acq arch/arm64/include/asm/cmpxchg.h:170 [inline] BUG: KASAN: slab-use-after-free in raw_atomic64_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4181 [inline] BUG: KASAN: slab-use-after-free in raw_atomic64_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4299 [inline] BUG: KASAN: slab-use-after-free in raw_atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-long.h:1482 [inline] BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4458 [inline] BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible+0x10/0x70 kernel/locking/mutex.c:1109 Write at addr faf0000016813780 by task syz.3.150/3858 Pointer tag: [fa], memory tag: [fe] CPU: 0 UID: 0 PID: 3858 Comm: syz.3.150 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C) show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x1c4/0x4b0 mm/kasan/report.c:482 kasan_report+0x84/0xac mm/kasan/report.c:595 report_tag_fault arch/arm64/mm/fault.c:368 [inline] do_tag_recovery arch/arm64/mm/fault.c:380 [inline] __do_kernel_fault+0x1b4/0x220 arch/arm64/mm/fault.c:424 do_bad_area+0x68/0x80 arch/arm64/mm/fault.c:529 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:909 do_mem_abort+0x40/0x90 arch/arm64/mm/fault.c:985 el1_abort+0x44/0x64 arch/arm64/kernel/entry-common.c:342 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:469 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:585 __lse__cmpxchg_case_acq_64 arch/arm64/include/asm/atomic_lse.h:272 [inline] (P) __cmpxchg_case_acq_64 arch/arm64/include/asm/cmpxchg.h:122 [inline] (P) __cmpxchg_acq arch/arm64/include/asm/cmpxchg.h:170 [inline] (P) raw_atomic64_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4181 [inline] (P) raw_atomic64_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4299 [inline] (P) raw_atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-long.h:1482 [inline] (P) atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4458 [inline] (P) __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] (P) mutex_lock_interruptible+0x10/0x70 kernel/locking/mutex.c:1109 (P) do_dentry_open+0x128/0x4fc fs/open.c:996 vfs_open+0x2c/0xe8 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x5b4/0x960 fs/namei.c:5000 do_file_open+0xb0/0x168 fs/namei.c:5029 do_sys_openat2+0x84/0x104 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __arm64_sys_openat+0x64/0xc0 fs/open.c:1434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 Allocated by task 3857: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 save_stack_info+0x40/0x160 mm/kasan/tags.c:106 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] poison_kmalloc_redzone mm/kasan/common.c:371 [inline] __kasan_kmalloc+0xf8/0x120 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x1d0/0x470 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1610 [inline] gadgetfs_bind+0xd0/0x3c0 drivers/usb/gadget/legacy/inode.c:1701 gadget_bind_driver+0x90/0x284 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0xbc/0x2bc drivers/base/dd.c:706 __driver_probe_device+0x11c/0x184 drivers/base/dd.c:868 driver_probe_device+0x3c/0x114 drivers/base/dd.c:898 __driver_attach+0x90/0x180 drivers/base/dd.c:1292 bus_for_each_dev+0x7c/0xdc drivers/base/bus.c:383 driver_attach+0x24/0x30 drivers/base/dd.c:1310 bus_add_driver+0xe4/0x208 drivers/base/bus.c:763 driver_register+0x68/0x130 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x54/0xfc drivers/usb/gadget/udc/core.c:1752 dev_config+0x214/0x484 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0xd4/0x36c fs/read_write.c:685 ksys_write+0x70/0x108 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x18/0x24 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 Freed by task 3857: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 save_stack_info+0x40/0x160 mm/kasan/tags.c:106 kasan_save_free_info+0x18/0x40 mm/kasan/tags.c:147 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0xe8/0x160 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x150/0x420 mm/slub.c:6792 put_ep.part.0+0x44/0x60 drivers/usb/gadget/legacy/inode.c:225 put_ep include/linux/refcount.h:396 [inline] destroy_ep_files+0x104/0x170 drivers/usb/gadget/legacy/inode.c:1591 gadgetfs_unbind+0x7c/0xc0 drivers/usb/gadget/legacy/inode.c:1664 gadget_unbind_driver+0x7c/0x118 drivers/usb/gadget/udc/core.c:1724 device_remove+0x4c/0x80 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x1cc/0x224 drivers/base/dd.c:1372 driver_detach+0x4c/0xb0 drivers/base/dd.c:1435 bus_remove_driver+0x6c/0xbc drivers/base/bus.c:832 driver_unregister+0x30/0x60 drivers/base/driver.c:202 usb_gadget_unregister_driver+0x20/0x40 drivers/usb/gadget/udc/core.c:1784 dev_release+0x68/0x80 drivers/usb/gadget/legacy/inode.c:1207 __fput+0xcc/0x2f8 fs/file_table.c:512 ____fput+0x14/0x20 fs/file_table.c:540 task_work_run+0x70/0xe0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x168/0x19c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x1f0/0x1fc arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 The buggy address belongs to the object at fff0000016813780 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of 192-byte region [fff0000016813780, fff0000016813840) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56813 flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: f5(slab) raw: 01ffc00000000000 f0f0000003401300 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000150015 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: fff0000016813500: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fff0000016813600: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >fff0000016813700: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ fff0000016813800: fe fe fe fe f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 fe fff0000016813900: fb fb fb fb fb fb fb fb fb fb fb fe fe fe fe fe ==================================================================