Extracting prog: 11m1.630784868s
Minimizing prog: 1h20m39.11229311s
Simplifying prog options: 13m52.85561105s
Extracting C: 5m50.431526317s
Simplifying C: 0s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG-socket-bind$auto-socket-close_range$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)
socket(0x23, 0x1, 0x2)
close_range$auto(0x2, 0x8000, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 22, 21, 21, 24, 24, 24, 25, 25, 21, 25, 25, 25, 22, 25, 22, 25, 22, 25, 21, 25, 25, 16, 25, 23, 25, 25, 21, 22, 25, 25]
detailed listing:
executing program 0:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio1\x00', 0x221c2, 0x0)
mlockall$auto(0x0)
rseq$auto(0x0, 0x8000, 0x100, 0x4)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x5, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
write$auto(0x3, 0x0, 0x100082)
mmap$auto(0x0, 0x0, 0x2, 0x13, 0x401, 0x8000)
clone$auto(0x3, 0x8000000000000001, 0xffffffffffffffff, 0xfffffffffffffffc, 0x6)
writev$auto(0x1, &(0x7f0000000100)={0x0, 0x400000000000fdef}, 0x1)
socket(0x1d, 0x1, 0x1000003)
write$auto_msr_fops_msr(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/kernel/security/tomoyo/query\x00', 0x400, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x4040, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/consoles\x00', 0x0, 0x0)
sendfile$auto(0x2, 0x3, 0x0, 0xc3e0)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000001080)='/dev/swradio0\x00', 0x101000, 0x0)
read$auto_v4l2_fops_v4l2_dev(r1, &(0x7f00000001c0)=""/191, 0x1f8)
read$auto_tomoyo_operations_securityfs_if(r0, 0x0, 0x0)
read$auto(r0, &(0x7f0000001200)='\xefI5\x1d\xc4~\xd0>\xd2;\xbcj\xce\x18+\x9blE\x18\xa1>V\n\xa4\x90cgy\x98O\xf4\x7f\xe0\xbf\xbb\x9f\xfc\xfb\x870l0\xcf\xb4\rx\xcb\bpg<ez\x87\xe6\xd9\x8dq5 \xf4J\xe8\xd6I\xaf\x04\xb8\xf1\x8a\xa8(\x1e\xc8\x8a\x05\x9b0\xa4\x06\xf9\x8f\xde\x16!\x9b\xd2\xb1\x81\x97\\\x8a,@\x02.p\xf6\xbe\xeaG1C\xd1~\xee\v\x19\x1c\xdd\n\xdc\x83\xb5\xb1\x8b\xc5U\xee\x92\x9e8.\x05R\x90\xab\x8c\x18.*YnZ\xb1\xe2\xec\xe6\xf2\x8d\x03A~\xa8_uk$\xce\xbe?\xd5\x11\r\xadQ\xdb\xc3w\x04r\x84\x92\x1b\xb4\x81*}\xc6\x1ev+\xb7\xb3X\x034\xcf\xce\x06Y\xef\x1a,\xc9\x88\x1d\xcd\x9b\xba\xf7\xca\x99\xe8\t\xbf_\xf2{\x9f\xb8\xe9\xf9\x05\xc8\xd1\x8e\"\xaa\xc0\x9d$\xfaE/\xf75\xfb\xe6\xbb\xe7\xdc', 0x20000074d)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x221c2, 0x0)
mlockall$auto(0x0)
rseq$auto(&(0x7f0000000300)={0xa, 0x7c, 0x0, 0x6, 0x0, 0x2}, 0x8000, 0x100, 0x4)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x5, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
write$auto(0x3, 0x0, 0x100082)
mmap$auto(0x0, 0x0, 0x2, 0x13, 0x401, 0x8000)
clone$auto(0x3, 0x8000000000000001, 0xffffffffffffffff, 0xfffffffffffffffc, 0x6)
writev$auto(0x1, &(0x7f0000000100)={0x0, 0x400000000000fdef}, 0x1)
socket(0x1d, 0x1, 0x1000003)
write$auto_msr_fops_msr(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/kernel/security/tomoyo/query\x00', 0x400, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x4040, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/consoles\x00', 0x0, 0x0)
sendfile$auto(0x2, 0x3, 0x0, 0xc3e0)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000001080)='/dev/swradio0\x00', 0x101000, 0x0)
read$auto_v4l2_fops_v4l2_dev(r1, &(0x7f00000001c0)=""/191, 0x1f8)
read$auto_tomoyo_operations_securityfs_if(r0, 0x0, 0x0)
read$auto(r0, &(0x7f0000001200)='\xefI5\x1d\xc4~\xd0>\xd2;\xbcj\xce\x18+\x9blE\x18\xa1>V\n\xa4\x90cgy\x98O\xf4\x7f\xe0\xbf\xbb\x9f\xfc\xfb\x870l0\xcf\xb4\rx\xcb\bpg<ez\x87\xe6\xd9\x8dq5 \xf4J\xe8\xd6I\xaf\x04\xb8\xf1\x8a\xa8(\x1e\xc8\x8a\x05\x9b0\xa4\x06\xf9\x8f\xde\x16!\x9b\xd2\xb1\x81\x97\\\x8a,@\x02.p\xf6\xbe\xeaG1C\xd1~\xee\v\x19\x1c\xdd\n\xdc\x83\xb5\xb1\x8b\xc5U\xee\x92\x9e8.\x05R\x90\xab\x8c\x18.*YnZ\xb1\xe2\xec\xe6\xf2\x8d\x03A~\xa8_uk$\xce\xbe?\xd5\x11\r\xadQ\xdb\xc3w\x04r\x84\x92\x1b\xb4\x81*}\xc6\x1ev+\xb7\xb3X\x034\xcf\xce\x06Y\xef\x1a,\xc9\x88\x1d\xcd\x9b\xba\xf7\xca\x99\xe8\t\xbf_\xf2{\x9f\xb8\xe9\xf9\x05\xc8\xd1\x8e\"\xaa\xc0\x9d$\xfaE/\xf75\xfb\xe6\xbb\xe7\xdc', 0x20000074d)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000040), 0x1c8281, 0x0)
mmap$auto(0x0, 0x9, 0x3ff57697, 0x9b72, r0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x5, 0x80009}, 0x7}, 0x101, 0x0)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x11f, 0x0, 0xfffffffffffffffd)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(r0, 0x0, 0x1)
connect$auto(0x3, 0x0, 0x51)
getrandom$auto(0x0, 0x6000000, 0x3)
socket(0x2, 0x1, 0x8000)
setsockopt$auto(0x3, 0x0, 0x22, 0x0, 0x28)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
ioctl$auto(r2, 0x5428, 0x7)
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xb02, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
mmap$auto(0x0, 0x20000a, 0xffffffffffffffff, 0x20000040eb1, 0xffffffffffffffff, 0x300000000000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000500)='/sys/devices/virtual/block/ram12/queue/read_ahead_kb\x00', 0x80000, 0x0)
read$auto(r0, 0x0, 0x20)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
iopl$auto(0x2)
execve$auto(&(0x7f0000000000)=':,\x00', 0x0, 0x0)
migrate_pages$auto(0x0, 0x3, &(0x7f0000000100)=0x7, &(0x7f0000000140)=0x2)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto_PR_MPX_DISABLE_MANAGEMENT(0x2c, 0xffff, 0xffffffffffffffff, 0x8, 0x1)
fanotify_init$auto(0x65, 0x2)
syz_genetlink_get_family_id$auto_nfc(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_LLC_GET_PARAMS(0xffffffffffffffff, 0x0, 0x10)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system/memory/memory12/power/control\x00', 0x100, 0x0)
close_range$auto(0x0, 0x5, 0x0)
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4004810}, 0x0)
r0 = socket(0x2, 0x80002, 0x73)
r1 = socket(0xa, 0x1, 0x84)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x33a00, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x6, 0x0)
bpf$auto(0x4, &(0x7f00000001c0)=@bpf_attr_3={0x8, 0x3, 0x6, 0x4, 0x7, 0x8, 0x4, 0x6, 0x9, "fcaeffda94bae011dd91874d2ac6834d", 0x0, 0x8, r0, 0x8, 0x9, 0x3, 0xb, 0x81, 0xbd9, 0x62, @attach_prog_fd=r1, 0xf, 0x4, 0x81, 0x1, 0x5, r0}, 0x37)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/platform/dummy_hcd.5/usb6/6-0:1.0/usb6-port1/location\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000100)=""/188, 0xbc)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48402, 0x0)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0)
ioctl$auto(0x3, 0x400c4d01, r3)
statx$auto(0xffffffffffffffff, 0x0, 0xf2e1, 0xf, 0x0)
syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff)
write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000000300)="0000e3813213b2", 0x7)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
close_range$auto(0x2, 0x8, 0x0)
executing program 0:
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, 0x0, 0x20201, 0x0)
write$auto(0x3, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write$auto_kernfs_file_fops_kernfs_internal(r1, 0x0, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
syz_genetlink_get_family_id$auto_ovs_datapath(&(0x7f00000001c0), r0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x10b142, 0x0)
sendfile$auto(r2, r2, 0x0, 0x200)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
bpf$auto(0x0, 0x0, 0xa3)
close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x5)
socket(0x2, 0x1, 0x106)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x300, 0x0)
socket(0x2b, 0x6, 0x0)
sendmsg$auto_WG_CMD_GET_DEVICE(0xffffffffffffffff, 0x0, 0x20008000)
r3 = socket(0x3, 0x1, 0x6)
io_uring_setup$auto(0x7, &(0x7f0000000000)={0x10000, 0x80, 0xe, 0x8, 0x1fd, 0x4, r3, [0x7fffffff, 0x8, 0x6], {0x5, 0x800000a, 0x200, 0xffffffff, 0x81, 0x1ff, 0x7, 0x8, 0x200}, {0x1136400, 0x72, 0x1800000, 0x4, 0x8, 0x4, 0x3b72, 0x80, 0xffffffffffffffff}})
write$auto(0x3, 0x0, 0x3f00)
executing program 32:
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, 0x0, 0x20201, 0x0)
write$auto(0x3, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write$auto_kernfs_file_fops_kernfs_internal(r1, 0x0, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
syz_genetlink_get_family_id$auto_ovs_datapath(&(0x7f00000001c0), r0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x10b142, 0x0)
sendfile$auto(r2, r2, 0x0, 0x200)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
bpf$auto(0x0, 0x0, 0xa3)
close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x5)
socket(0x2, 0x1, 0x106)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x300, 0x0)
socket(0x2b, 0x6, 0x0)
sendmsg$auto_WG_CMD_GET_DEVICE(0xffffffffffffffff, 0x0, 0x20008000)
r3 = socket(0x3, 0x1, 0x6)
io_uring_setup$auto(0x7, &(0x7f0000000000)={0x10000, 0x80, 0xe, 0x8, 0x1fd, 0x4, r3, [0x7fffffff, 0x8, 0x6], {0x5, 0x800000a, 0x200, 0xffffffff, 0x81, 0x1ff, 0x7, 0x8, 0x200}, {0x1136400, 0x72, 0x1800000, 0x4, 0x8, 0x4, 0x3b72, 0x80, 0xffffffffffffffff}})
write$auto(0x3, 0x0, 0x3f00)
executing program 1:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
io_uring_setup$auto(0xa, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000380)='/sys/module/ima/parameters/ahash_bufsize\x00', 0x62, 0x0)
write$auto(r0, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
close_range$auto(0x2, 0xa, 0x0)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video63\x00', 0x80800, 0x0)
read$auto_v4l2_fops_v4l2_dev(r1, &(0x7f00000001c0)=""/191, 0x1f8)
getsockopt$auto_SO_TIMESTAMPING_NEW(r1, 0x4, 0x41, &(0x7f0000000000)='/proc/fs/ext4/sda1/mb_groups\x00', &(0x7f0000000080)=0x6772)
fcntl$auto(0x0, 0x407, 0x1)
open(0x0, 0xa240, 0x15e)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
fallocate$auto(0x8000000000000003, 0x0, 0xd, 0xcbd5d)
fallocate$auto(0x3, 0x3, 0x92d4, 0x7)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/ext4/sda1/mb_groups\x00', 0x10b402, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/pcrypt/pencrypt/serial_cpumask\x00', 0xa001, 0x0)
write$auto(r2, &(0x7f0000000040)=',\x00^\xa2\x02\x00\x00\x00\x00\x00\xd8l\x00\x00\x00\x00\x00\x00\xb2s\x83\xbd\xc5_%\xc1\xa3\xd0\x95Hq\xf4zG\x01[{\x17\x05I\xe0\xb1d)\x06z8L\xe6&[\xa9X6\x7f\xec\x94\xdal\xa1\xbb\x86\x9c\xc2\xef\x02\r9%\x06\xc5\'b%m_\x96A\"\xdd\xe40\xa7\xc3\x9ah\xf3B\xc2\xec\xf8\r\f[\xe5\x9dK\xe1\x99\x86\xfc\xac\x9f\x8a', 0x1000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$auto_SO_ATTACH_BPF(r3, 0x1, 0x32, &(0x7f0000000180)='/dev/mtd0\x00', 0x4)
arch_prctl$auto_ARCH_SHSTK_ENABLE(0x5001, 0x40)
open(0x0, 0x161342, 0x100)
executing program 1:
syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
ioctl$auto(r0, 0x4b40, 0xffffffffffffffff)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
statmount$auto(0x0, &(0x7f0000000180)={0x8000008, 0x1, 0x38a1, 0x3, 0x26, 0x940, 0x1ffde, 0x3, 0x6, 0x902c, 0x6, 0x400005, 0x3, 0x4, 0xb0, 0x8, 0x10000000009, 0x3, 0x5, 0x6, 0x8, 0xffffffff, 0x0, 0x0, 0x0, 0x0, [0x3, 0x3, 0x200000000, 0x400000000, 0x0, 0x3901, 0x0, 0x4, 0x3, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0xffffffeffffffffe, 0x4, 0x0, 0xceb, 0x7fffffff, 0xfffffffffffffffc, 0x0, 0x5, 0x96f, 0xffffffffffffffff, 0x2, 0x4001, 0x3, 0x0, 0x100b548, 0x8, 0x1, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x3]}, 0xfffff7fffffffffa, 0x81)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2c, 0x3, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
getsockopt$auto(0x6, 0x11b, 0x1, 0xfffffffffffffffe, 0x0)
read$auto(r1, 0x0, 0x20)
openat$auto_cachefiles_daemon_fops_internal(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001980)={0x3c, r3, 0x1b, 0x70bd26, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_PROBE={0x4}, @OVS_PACKET_ATTR_ACTIONS={0xc, 0x3, 0x0, 0x1, [@nested={0x8, 0x14, 0x0, 0x1, [@nested={0x4, 0x5}]}]}, @OVS_PACKET_ATTR_PACKET={0x12, 0x1, "898771f1c19f1779048590828847"}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r4 = openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/usb/usbmon/32u\x00', 0x0, 0x0)
socketcall$auto_SYS_RECVMSG(0x11, &(0x7f0000000040)=0x7f)
openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/usb/usbmon/10t\x00', 0x40, 0x0)
read$auto_mon_fops_text_t_mon_text(r4, 0x0, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
executing program 1:
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon26\x00', 0x40000, 0x0)
timerfd_create$auto(0x0, 0x0)
socket(0x2, 0x6, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/dummy_hcd.4/usb5/ep_00/wMaxPacketSize\x00', 0x8100, 0x0)
socket(0x25, 0x1, 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
socket(0xa, 0x3, 0x73)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
ioctl$auto(r0, 0x5423, 0x9)
executing program 4:
unshare$auto(0x40000080)
socket(0x1d, 0x2, 0x6)
openat$auto_fops_blob_file(0xffffffffffffff9c, &(0x7f0000011500), 0x40002, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ptyc9\x00', 0x20c40, 0x0)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080))
openat$auto_proc_mounts_operations_mnt_namespace(0xffffffffffffff9c, 0x0, 0x121080, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x40000c, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/block/loop9/queue/rotational\x00', 0x242401, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40d40, 0x1a0)
socket(0x10, 0x2, 0x14)
r0 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyaf\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
write$auto(0x3, 0x0, 0xffd8)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
semtimedop$auto(0x3, 0x0, 0x8, &(0x7f00000000c0)={0xf3c7, 0x5})
userfaultfd$auto(0x1)
read$auto(r0, &(0x7f0000000040)='/dev/ptyc9\x00', 0x9)
close_range$auto(0x2, 0x8, 0x0)
executing program 2:
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
mkdir$auto(&(0x7f00000000c0)='./file1\x00', 0x8)
signalfd$auto(0xffffffff, 0x0, 0x8)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1/file0\x00', 0x840, 0xc)
socket(0x1d, 0x2, 0x6)
socket(0x2, 0x2, 0x1)
io_uring_setup$auto(0x6, 0x0)
io_uring_setup$auto(0x6, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/009/001\x00', 0xa101, 0x0)
io_uring_setup$auto(0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x100480, 0x0)
socketpair$auto(0x4004, 0xf, 0x4, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
ioctl$auto_TCFLSH2(r0, 0x400455c8, 0x0)
set_mempolicy$auto(0x2, 0x0, 0x4)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
r2 = socket(0xa, 0x6, 0x0)
listen$auto(r2, 0x26da)
close_range$auto(0x2, r2, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
executing program 1:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
setgroups$auto(0xe32, 0x0)
ppoll$auto(0x0, 0x9, 0x0, 0x0, 0x8)
madvise$auto(0x0, 0x200007, 0x19)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x111, 0x2, 0x8000)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram14\x00', 0xe4242, 0x0)
close_range$auto(0x2, 0x8, 0x0)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000000), r1)
sendmsg$auto_ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x1, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000840}, 0x2000c840)
bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x4e23}, 0x67)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x2, 0xb}, 0x800009}, 0x5, 0x20000000)
mremap$auto(0x8000000000000004, 0x0, 0x401, 0xfffffffffffffffe, 0x1ffffffe)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
socket(0xa, 0x2, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x6, 0x0)
bpf$auto(0x0, 0x0, 0xfbf)
shutdown$auto(0x200000003, 0x2)
executing program 2:
r0 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000040), 0x1c8281, 0x0)
mmap$auto(0x0, 0x9, 0x3ff57697, 0x9b72, r0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{0x0, 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x5, 0x80009}, 0x7}, 0x101, 0x0)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x11f, 0x0, 0xfffffffffffffffd)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(r0, 0x0, 0x1)
connect$auto(0x3, 0x0, 0x51)
getrandom$auto(0x0, 0x6000000, 0x3)
socket(0x2, 0x1, 0x8000)
setsockopt$auto(0x3, 0x0, 0x22, 0x0, 0x28)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
ioctl$auto(r2, 0x5428, 0x7)
executing program 4:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
write$auto_fuse_dev_operations_fuse_i(0xffffffffffffffff, &(0x7f0000000440)="11000000126584", 0x7)
mmap$auto(0x0, 0x20007, 0x9, 0xeb1, 0x403, 0x8000)
kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x2aa7, 0x6c0000c000, 0xc000}, 0x4)
r0 = socket(0x2, 0x1, 0x0)
ioctl$auto_RTC_ALM_READ(0xffffffffffffffff, 0x80247008, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/midiC2D0\x00', 0x1e1001, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/009/001\x00', 0xa101, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x4, 0x15f4da0a, 0x1, 0x3, 0x1000000, 0x80000001, 0x7, 0x6d3c, 0x5, 0x2]}, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
faccessat2$auto(r0, &(0x7f0000000100)='./file1\x00', 0x3, 0x2)
madvise$auto(0x0, 0x7fffffffffffffff, 0xa)
futex$auto(&(0x7f0000000080)=0x3, 0xb, 0x1, 0x0, 0x0, 0xfffffffa)
mkdir$auto(&(0x7f0000000040)='./file0\x00', 0x2)
mknodat$auto(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0xfff, 0xfffffff8)
renameat2$auto(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000240)='./file1\x00', 0x1)
r2 = openat$dir(0xffffffffffffff9c, 0x0, 0x8000, 0x70)
mkdir$auto(&(0x7f0000000000)='./file0/file0\x00', 0x3)
renameat2$auto(r2, &(0x7f0000000200)='./file0\x00', r2, &(0x7f0000000240)='./file1\x00', 0x2)
r3 = openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000000)='/dev/usbmon8\x00', 0x881, 0x0)
ioctl$auto_MON_IOCX_GETX(r3, 0x4018920a, &(0x7f00000000c0)={0x0, 0x0, 0x4})
read$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffffff, &(0x7f0000001100)=""/4096, 0x1000)
executing program 2:
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram2\x00', 0x14f642, 0x0)
mmap$auto(0x7fff, 0x400008, 0xda, 0x9b72, 0x2, 0x480000000008001)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
getrandom$auto(0x0, 0x6000000, 0x3)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400020009, 0x10000000000df, 0x13, 0x8000000401, 0x7fffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
io_uring_setup$auto(0x6, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
memfd_create$auto(0x0, 0x9)
mmap$auto(0x0, 0x20009, 0x20004000000000df, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_DISASSOCIATE(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x8)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS0\x00', 0x1, 0x0)
write$auto(r1, 0x0, 0x5)
executing program 3:
socket(0x11, 0x3, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/usb/usbmon/9t\x00', 0x800, 0x0)
openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000980)='/proc/self/pagemap\x00', 0x188880, 0x0)
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000100)='/dev/usbmon20\x00', 0x40080, 0x0)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
mkdir$auto(&(0x7f00000000c0)='./file1\x00', 0x8)
signalfd$auto(0xffffffff, 0x0, 0x8)
openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x143000, 0x0)
socket(0x10, 0x3, 0xa)
socket(0x1d, 0x2, 0x6)
socket(0x2, 0x2, 0x1)
io_uring_setup$auto(0xfff, 0x0)
io_uring_setup$auto(0x6, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/009/001\x00', 0xa100, 0x0)
pipe$auto(0x0)
pipe$auto(0x0)
io_uring_setup$auto(0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
socketpair$auto(0x4004, 0xf, 0x4, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
ioctl$auto_TCFLSH2(r0, 0x540b, 0x0)
executing program 4:
r0 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000040), 0x1c8281, 0x0)
mmap$auto(0x0, 0x9, 0x3ff57697, 0x9b72, r0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
sendmmsg$auto(0x3, 0x0, 0x101, 0x0)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x11f, 0x0, 0xfffffffffffffffd)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(r0, 0x0, 0x1)
connect$auto(0x3, 0x0, 0x51)
getrandom$auto(0x0, 0x6000000, 0x3)
socket(0x2, 0x1, 0x8000)
setsockopt$auto(0x3, 0x0, 0x22, 0x0, 0x28)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
ioctl$auto(r2, 0x5428, 0x7)
executing program 3:
r0 = socket(0x10, 0x2, 0xf)
ioctl$auto___SNDRV_PCM_IOCTL_SYNC_PTR64(0xffffffffffffffff, 0xc0884123, &(0x7f0000000180)={0x1, 0x0, @reserved="8c0063afd519ee73a1991b704222e8acfcee74abf3682dc9a8783bd6424bb319e08e5c50f551e15e4efc5f05f5ce98f82ce29d7b5f908d12bad623e9627762bf", @control={{}, 0x6c, {}, {}, 0x8}})
r1 = bpf$auto(0x0, &(0x7f0000000080)=@bpf_attr_4={0x1e, <r2=>r0, 0xffffffff}, 0xd)
openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/extfrag/unusable_index\x00', 0x2, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x10000, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0xb6f3, 0x2, 0x100000001)
io_uring_setup$auto(0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0x4020ae76, 0x38)
socket(0x2b, 0x1, 0x1)
listen$auto(0x3, 0x83)
ioctl$auto(0x3, 0x541b, 0x38)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x2000040eb2, r2, 0x1)
r4 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x2001, 0x0)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/devices/virtual/mac80211_hwsim/hwsim1/ieee80211/phy1/rfkill3/soft\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000000080)=""/64, 0x40)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x20000411, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x7, 0x3)
membarrier$auto(0x2, 0x100000000, 0x8000000000000001)
ioctl$auto_USB_RAW_IOCTL_EPS_INFO(r4, 0x83c0550b, 0x0)
r6 = openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/pcmC0D0p\x00', 0x1a1280, 0x0)
ioctl$auto_SNDRV_PCM_IOCTL_PVERSION(r6, 0x80044100, 0x0)
bpf$auto(0x2, &(0x7f0000000080)=@iter_create={r1, 0x98}, 0x5)
executing program 3:
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon26\x00', 0x40000, 0x0)
timerfd_create$auto(0x0, 0x0)
socket(0x2, 0x6, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/dummy_hcd.4/usb5/ep_00/wMaxPacketSize\x00', 0x8100, 0x0)
socket(0x25, 0x1, 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
socket(0xa, 0x3, 0x73)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
ioctl$auto(r0, 0x5423, 0x9)
executing program 1:
r0 = socket(0x2, 0x5, 0x0)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000240), 0x40, 0x0)
getcwd$auto(0x0, 0xffffffffffffffff)
setsockopt$auto(0x3, 0x10000000084, 0x2, 0x0, 0x8)
futex$auto(&(0x7f0000000000)=0xf0fe, 0x5, 0x4, 0x0, &(0x7f0000000080)=0x9, 0x3000000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
io_cancel$auto(0x7, 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x1fff8}, 0x7, 0x0, 0x2, 0xb}, 0xfff}, 0x5, 0x311)
openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/pagemap\x00', 0x0, 0x0)
ioperm$auto(0x3, 0x8001, 0x2000000000000149)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mbind$auto(0x9, 0x84, 0x4, &(0x7f0000000000), 0x80000000, 0x7f)
socket(0xa, 0x2, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x6, 0x0)
shutdown$auto(0x200000003, 0x2)
sendmsg$auto_NLBL_MGMT_C_LISTDEF(0xffffffffffffffff, 0x0, 0x20048800)
unshare$auto(0x40000080)
recvmmsg$auto(0x3, 0x0, 0x687bcbd, 0x8, 0x0)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0x6, 0x8000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'})
r1 = fcntl$auto_F_UNLCK(0xffffffffffffffff, 0x80000001, 0x2)
ioctl$auto__ctl_fops_dm_ioctl(r1, 0x5, &(0x7f0000000300)="45195a192c1cba299d214d93530d8173bbd8885d68522857a9db119cf4e5447129346f95ab5438d27cfa4c0970559bcc5a0d974c1005ff567a0d7841789654a0dbd777af384803c1f98654")
read$auto(r0, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
socket(0x10, 0x2, 0xf)
mmap$auto(0x0, 0xc, 0xfff, 0x44eb2, 0x10006, 0x300000000000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x40000, 0x0)
r3 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/stack\x00', 0x181100, 0x0)
read$auto_proc_single_file_operations_base(r3, &(0x7f0000000080)=""/112, 0x70)
r4 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bus/usb/009/001\x00', 0x103181, 0x0)
ioctl$auto(r4, 0x802c550a, 0x1)
shutdown$auto(r4, 0x5)
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00')
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
setresuid$auto(0x8, 0x8, 0x0)
setfsuid$auto(0x0)
r5 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sda\x00', 0x8001, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$auto_psample(&(0x7f0000007a40), 0xffffffffffffffff)
sendmsg$auto_PSAMPLE_CMD_GET_GROUP(r6, &(0x7f0000007b00)={0x0, 0x0, &(0x7f0000007ac0)={&(0x7f0000007a80)={0x14, r7, 0x311, 0x70bd29, 0x25dfdbfe}, 0x14}}, 0x0)
ioctl$auto(r5, 0x401070cd, 0x5)
executing program 3:
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
socket(0x11, 0x80003, 0x300)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm1p/sub2/xrun_injection\x00', 0x4a040, 0x0)
syz_genetlink_get_family_id$auto_ovs_flow(0x0, 0xffffffffffffffff)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfd, 0x8000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS3\x00', 0x0, 0x0)
move_pages$auto(0x1, 0x233, 0x0, 0x0, 0x0, 0x8000000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x3, 0x3b)
read$auto(0x3, 0x0, 0x80)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x3, 0xb, 0x5, 0x1ffde, 0x3, 0x6, 0x2, 0x9, 0x5, 0x3, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb2, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x2]}, 0x1fe, 0x81)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x8)
executing program 2:
mq_open$auto(&(0x7f0000000280)='\\*)A\x00', 0x7e, 0x9, 0x0)
r0 = socket(0x2b, 0x1, 0x1)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/trace_pipe\x00', 0x2000, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="0300ffffffe6", @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x40014}, 0x80)
r1 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, 0x0, 0x200, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r1, 0x6f29, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0x42, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/midiC2D3\x00', 0x2001, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000380)={[0x1ff, 0xd5b, 0xc, 0x9, 0x948a, 0x2, 0x15f6da08, 0xfffffffffffffffe, 0x3, 0x300000000000600, 0x40080000001, 0x7, 0x6d3c, 0x6, 0x9]}, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r3 = io_uring_setup$auto(0x6, 0x0)
setsockopt$auto(0x3, 0x1, 0xf, 0x0, 0x9)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_wireguard(0x0, r4)
r5 = open(0x0, 0x261c2, 0x84)
ftruncate$auto(r5, 0xa0)
lseek$auto(0x3, 0x2, 0x4)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_NETDEV_CMD_PAGE_POOL_GET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x48040}, 0x4000)
connect$auto(0x3, 0x0, 0x55)
socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000040)={0x1, 0x0, 0x36, 0x828, 0x9, 0x8000000000000000, 0x9f, 0x7, 0x9, 0x8, 0x2, 0x9, 0x3, 0x10000000000008, 0x0, 0x200000000000f, 0x100, 0x40000001, 0x10001, 0x2cf8, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4]}, 0xe3c, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x40}, 0x40000)
executing program 3:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$auto_sc_seq_fops_netdebug(0xffffffffffffff9c, &(0x7f0000000040), 0x88080, 0x0)
io_uring_setup$auto(0x59, &(0x7f0000000080)={0x1, 0xd, 0x3000, 0x5, 0x4, 0x7fffffff, r0, [], {0x6, 0x6, 0x3b5a, 0x21f, 0x102, 0x7ffffffb, 0x101, 0x8, 0x3}, {0x100, 0x1, 0x52, 0x405, 0x2, 0x60, 0x76c5, 0x8, 0x100000000}})
unshare$auto(0x40000080)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x202002, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x2, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x4, 0x2, 0x15f4da0a, 0x1, 0x7fff, 0x300000000000000, 0x80000001, 0xdc, 0x6d3c, 0x0, 0x2, 0x2e]}, 0x0)
close_range$auto(0x2, 0x8, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x8002, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x80805, 0x0)
eventfd$auto(0x7)
select$auto(0x5, 0x0, 0x0, &(0x7f00000001c0)={[0x1aa57c94, 0x95, 0x5, 0x100000003, 0x8475, 0x6, 0x1, 0x9, 0xec, 0x2, 0x8, 0x8, 0x5, 0x7]}, 0x0)
writev$auto(0x4, &(0x7f0000000080)={&(0x7f0000000040), 0x8}, 0x1)
r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0)
write$auto(r2, 0x0, 0xb6)
write$auto(0x3, 0x0, 0xffd8)
r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f00000000c0), r1)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000380)={0x200, r3, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@HWSIM_ATTR_IFTYPE_SUPPORT={0x8, 0x17, 0xbbcd}, @HWSIM_ATTR_ADDR_TRANSMITTER={0xdb, 0x2, "3f26e894fe582c3657357d6374fd299cbbc666c087594dcce58ed932154acf492c6d3474be04da758e57a84a83e818053b6652ea0a4a0a919b0c4420c4b16ec10be2fbfb78134f4af65e97d48caab13fe71dddeeb9601348ca1f24d4c3466c62f6f1ee76103af5b3943c57ede5603ad0b630c347f2b7bea62cb4a9c9e290c55279fd407c2c7b8884fcb7d27e62c4ce685838124a6ee9987190b0edf906b1ed96206eaecad0c2206f2ee876b8d492c34fb3e04a91362a75b43bf7d8dcfa9cb72219db4ed5d7286dda92f75efdf845023979836fc9746a72"}, @HWSIM_ATTR_CHANNELS={0x8, 0x9, 0x9}, @HWSIM_ATTR_PERM_ADDR={0x100, 0x16, "357d4b4548f177753c1e703e04063e1563683e95cf5f00f6e8a0f75922475d2ab852dd3b92b354a8772419f4a1ae0bbd6bb23fd47dffb42628d8bf77b4a4f2ec4f63c4327a6c77a5b3d1e17e00f3b643664a1ab151b76cdf90853427413f6f960086481dab8b80f1ad3e828dde4f42cf47f1401162b4e5c6fefa1de94e7e437df22298832a88c9dc2679ffe17a959d2e232ca10523e26c94a758eec164c35e154639e028eddb7cf97ecf2ad136b893b8a7b3151185d2c597a054cee75dd9383336552c9a2309b9dcc59d184b7ccc76c121959a7beee73560f9dea4f2ae004658f2239897f402e52338a1469c509ee86997c3202f1332b80f4266a655"}]}, 0x200}}, 0x80)
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0x80401, 0x0)
writev$auto(0x3, &(0x7f0000000100)={&(0x7f0000000340), 0x7111}, 0x8)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x200, 0x0)
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000040))
r2 = socket(0x15, 0x5, 0x0)
sendmsg$auto_NL80211_CMD_SET_TID_TO_LINK_MAPPING(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40040}, 0x4008010)
sched_setscheduler$auto(0x0, 0x8, &(0x7f0000000000)={0xfff})
fcntl$auto(r1, 0x402, 0x2)
sync_file_range$auto(r2, 0x9, 0xffffffffffff98b5, 0x5)
fcntl$auto(r1, 0x402, 0x0)
mmap$auto(0x7, 0x20009, 0x3, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x80091, 0x0)
writev$auto(r3, &(0x7f0000000000)={0x0, 0x710d}, 0x8000000000000001)
pread64$auto(r0, 0x0, 0x3f, 0x20007fff)
socket$nl_generic(0x10, 0x3, 0x10)
ioperm$auto(0x7, 0x6, 0x2)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0x7fffffffffffffff, 0xa)
r4 = open(&(0x7f00000000c0)='./cgroup\x00', 0x0, 0xb5d1af1605322df2)
syz_clone3(&(0x7f0000000200)={0x383281180, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/fs/cifs/smbd_max_send_size\x00', 0x2200, 0x0)
sendmsg$auto_NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x2404c800)
kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x800c000, 0x40000000, 0x800c000}, 0x4)
executing program 4:
set_mempolicy$auto(0x6, 0x0, 0x4)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x200006, 0x2, 0x40eb1, 0x602, 0x300000000000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_enter$auto(0x3, 0x1, 0x82400001, 0x0, 0x0, 0x18)
mmap$auto(0x0, 0x9, 0xdf, 0x1000000eb1, 0x401, 0x8000)
mknod$auto(0x0, 0x1081, 0x3)
close_range$auto(0x2, 0x8, 0x0)
creat$auto(0x0, 0x4)
creat$auto(0x0, 0x9)
open(0x0, 0x22242, 0x155)
setsockopt$auto(0xffffffffffffffff, 0x107, 0x9, 0x0, 0x6)
close_range$auto(0x2, 0x8, 0x0)
migrate_pages$auto(0xffffffffffffffff, 0x8, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
write$auto(0x3, 0x0, 0xfffffdef)
ioctl$auto(0x3, 0x5412, 0x38)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
ioctl$auto(0xffffffffffffffff, 0x8004510b, 0x3)
ioctl$auto__ctl_fops_dm_ioctl(0xffffffffffffffff, 0xfffffffffffffd02, &(0x7f00000001c0))
madvise$auto(0x110c230000, 0x8031ca, 0x9)
executing program 3:
socket(0xa, 0x3, 0x3a)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000003340)='/dev/sg0\x00', 0x202, 0x0)
write$auto_sg_fops_sg(r1, &(0x7f0000003380)="b25b1a8c398ef400dbcbc7a996eea7f3804ca6c7591adef6578d2f5f520f687f316ba7329774c854d58309037c0ae2ae6eb53b1d", 0x34)
sendmsg$auto_NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4004080}, 0x20040894)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
clock_gettime$auto(0x9, &(0x7f0000000000)={0x7, 0xb})
read$auto(0x3, 0x0, 0x80)
close_range$auto(0x2, 0xa, 0x0)
socket(0x18, 0xa, 0x1)
socket(0xa, 0x2, 0x0)
connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r2, 0x29, 0x1f, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_uprobe_events_ops_trace_uprobe(0xffffffffffffff9c, 0x0, 0x302, 0x0)
executing program 1:
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram2\x00', 0x14f642, 0x0)
mmap$auto(0x7fff, 0x400008, 0xda, 0x9b72, 0x2, 0x480000000008001)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
getrandom$auto(0x0, 0x6000000, 0x3)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400020009, 0x10000000000df, 0x13, 0x8000000401, 0x7fffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
io_uring_setup$auto(0x6, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000)
memfd_create$auto(0x0, 0x9)
mmap$auto(0x0, 0x20009, 0x20004000000000df, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_DISASSOCIATE(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x8)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS0\x00', 0x1, 0x0)
write$auto(r1, 0x0, 0x5)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
sendmsg$auto_NL80211_CMD_ABORT_SCAN(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x4008010)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
r1 = openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/buffer_size_kb\x00', 0x40, 0x0)
readv$auto(r1, &(0x7f0000000100)={0x0, 0x3}, 0x1)
read$auto(r0, 0x0, 0x6)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, 0x0, 0x802, 0x0)
writev$auto(r2, 0x0, 0x3)
mmap$auto(0x2000000, 0x2020009, 0x3, 0xeb1, 0xffff7ffffffffffa, 0x7fff)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101181, 0x0)
mmap$auto(0x0, 0x6, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mq_open$auto(&(0x7f0000000000)='.\xf1e4\xdf\x16\x95kxE\xd9x\x15\xb0\xf6V\x93\xb4E\x06\xc5}l', 0x400056a, 0x9, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0x8070ae9f, 0xffffffffffffffff)
timerfd_create$auto(0x9, 0x0)
openat$auto_tracing_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/per_cpu/cpu1/trace\x00', 0x1a6b75d63882a712, 0x0)
write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)
socket(0x23, 0x1, 0x2)
close_range$auto(0x2, 0x8000, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG-socket-bind$auto-socket-close_range$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)
socket(0x23, 0x1, 0x2)
close_range$auto(0x2, 0x8000, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 22, 21, 21, 24, 24, 24, 25, 25, 21, 25, 25, 25, 22, 25, 22, 25, 22, 25, 21, 25, 25, 16, 25, 23, 25, 25, 21, 22, 25, 25]
detailed listing:
executing program 0:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio1\x00', 0x221c2, 0x0)
mlockall$auto(0x0)
rseq$auto(0x0, 0x8000, 0x100, 0x4)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x5, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
write$auto(0x3, 0x0, 0x100082)
mmap$auto(0x0, 0x0, 0x2, 0x13, 0x401, 0x8000)
clone$auto(0x3, 0x8000000000000001, 0xffffffffffffffff, 0xfffffffffffffffc, 0x6)
writev$auto(0x1, &(0x7f0000000100)={0x0, 0x400000000000fdef}, 0x1)
socket(0x1d, 0x1, 0x1000003)
write$auto_msr_fops_msr(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/kernel/security/tomoyo/query\x00', 0x400, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x4040, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/consoles\x00', 0x0, 0x0)
sendfile$auto(0x2, 0x3, 0x0, 0xc3e0)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000001080)='/dev/swradio0\x00', 0x101000, 0x0)
read$auto_v4l2_fops_v4l2_dev(r1, &(0x7f00000001c0)=""/191, 0x1f8)
read$auto_tomoyo_operations_securityfs_if(r0, 0x0, 0x0)
read$auto(r0, &(0x7f0000001200)='\xefI5\x1d\xc4~\xd0>\xd2;\xbcj\xce\x18+\x9blE\x18\xa1>V\n\xa4\x90cgy\x98O\xf4\x7f\xe0\xbf\xbb\x9f\xfc\xfb\x870l0\xcf\xb4\rx\xcb\bpg<ez\x87\xe6\xd9\x8dq5 \xf4J\xe8\xd6I\xaf\x04\xb8\xf1\x8a\xa8(\x1e\xc8\x8a\x05\x9b0\xa4\x06\xf9\x8f\xde\x16!\x9b\xd2\xb1\x81\x97\\\x8a,@\x02.p\xf6\xbe\xeaG1C\xd1~\xee\v\x19\x1c\xdd\n\xdc\x83\xb5\xb1\x8b\xc5U\xee\x92\x9e8.\x05R\x90\xab\x8c\x18.*YnZ\xb1\xe2\xec\xe6\xf2\x8d\x03A~\xa8_uk$\xce\xbe?\xd5\x11\r\xadQ\xdb\xc3w\x04r\x84\x92\x1b\xb4\x81*}\xc6\x1ev+\xb7\xb3X\x034\xcf\xce\x06Y\xef\x1a,\xc9\x88\x1d\xcd\x9b\xba\xf7\xca\x99\xe8\t\xbf_\xf2{\x9f\xb8\xe9\xf9\x05\xc8\xd1\x8e\"\xaa\xc0\x9d$\xfaE/\xf75\xfb\xe6\xbb\xe7\xdc', 0x20000074d)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x221c2, 0x0)
mlockall$auto(0x0)
rseq$auto(&(0x7f0000000300)={0xa, 0x7c, 0x0, 0x6, 0x0, 0x2}, 0x8000, 0x100, 0x4)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x5, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
write$auto(0x3, 0x0, 0x100082)
mmap$auto(0x0, 0x0, 0x2, 0x13, 0x401, 0x8000)
clone$auto(0x3, 0x8000000000000001, 0xffffffffffffffff, 0xfffffffffffffffc, 0x6)
writev$auto(0x1, &(0x7f0000000100)={0x0, 0x400000000000fdef}, 0x1)
socket(0x1d, 0x1, 0x1000003)
write$auto_msr_fops_msr(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/kernel/security/tomoyo/query\x00', 0x400, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x4040, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/consoles\x00', 0x0, 0x0)
sendfile$auto(0x2, 0x3, 0x0, 0xc3e0)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000001080)='/dev/swradio0\x00', 0x101000, 0x0)
read$auto_v4l2_fops_v4l2_dev(r1, &(0x7f00000001c0)=""/191, 0x1f8)
read$auto_tomoyo_operations_securityfs_if(r0, 0x0, 0x0)
read$auto(r0, &(0x7f0000001200)='\xefI5\x1d\xc4~\xd0>\xd2;\xbcj\xce\x18+\x9blE\x18\xa1>V\n\xa4\x90cgy\x98O\xf4\x7f\xe0\xbf\xbb\x9f\xfc\xfb\x870l0\xcf\xb4\rx\xcb\bpg<ez\x87\xe6\xd9\x8dq5 \xf4J\xe8\xd6I\xaf\x04\xb8\xf1\x8a\xa8(\x1e\xc8\x8a\x05\x9b0\xa4\x06\xf9\x8f\xde\x16!\x9b\xd2\xb1\x81\x97\\\x8a,@\x02.p\xf6\xbe\xeaG1C\xd1~\xee\v\x19\x1c\xdd\n\xdc\x83\xb5\xb1\x8b\xc5U\xee\x92\x9e8.\x05R\x90\xab\x8c\x18.*YnZ\xb1\xe2\xec\xe6\xf2\x8d\x03A~\xa8_uk$\xce\xbe?\xd5\x11\r\xadQ\xdb\xc3w\x04r\x84\x92\x1b\xb4\x81*}\xc6\x1ev+\xb7\xb3X\x034\xcf\xce\x06Y\xef\x1a,\xc9\x88\x1d\xcd\x9b\xba\xf7\xca\x99\xe8\t\xbf_\xf2{\x9f\xb8\xe9\xf9\x05\xc8\xd1\x8e\"\xaa\xc0\x9d$\xfaE/\xf75\xfb\xe6\xbb\xe7\xdc', 0x20000074d)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000040), 0x1c8281, 0x0)
mmap$auto(0x0, 0x9, 0x3ff57697, 0x9b72, r0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x5, 0x80009}, 0x7}, 0x101, 0x0)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x11f, 0x0, 0xfffffffffffffffd)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(r0, 0x0, 0x1)
connect$auto(0x3, 0x0, 0x51)
getrandom$auto(0x0, 0x6000000, 0x3)
socket(0x2, 0x1, 0x8000)
setsockopt$auto(0x3, 0x0, 0x22, 0x0, 0x28)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
ioctl$auto(r2, 0x5428, 0x7)
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xb02, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
mmap$auto(0x0, 0x20000a, 0xffffffffffffffff, 0x20000040eb1, 0xffffffffffffffff, 0x300000000000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000500)='/sys/devices/virtual/block/ram12/queue/read_ahead_kb\x00', 0x80000, 0x0)
read$auto(r0, 0x0, 0x20)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
iopl$auto(0x2)
execve$auto(&(0x7f0000000000)=':,\x00', 0x0, 0x0)
migrate_pages$auto(0x0, 0x3, &(0x7f0000000100)=0x7, &(0x7f0000000140)=0x2)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto_PR_MPX_DISABLE_MANAGEMENT(0x2c, 0xffff, 0xffffffffffffffff, 0x8, 0x1)
fanotify_init$auto(0x65, 0x2)
syz_genetlink_get_family_id$auto_nfc(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_LLC_GET_PARAMS(0xffffffffffffffff, 0x0, 0x10)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system/memory/memory12/power/control\x00', 0x100, 0x0)
close_range$auto(0x0, 0x5, 0x0)
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4004810}, 0x0)
r0 = socket(0x2, 0x80002, 0x73)
r1 = socket(0xa, 0x1, 0x84)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x33a00, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x6, 0x0)
bpf$auto(0x4, &(0x7f00000001c0)=@bpf_attr_3={0x8, 0x3, 0x6, 0x4, 0x7, 0x8, 0x4, 0x6, 0x9, "fcaeffda94bae011dd91874d2ac6834d", 0x0, 0x8, r0, 0x8, 0x9, 0x3, 0xb, 0x81, 0xbd9, 0x62, @attach_prog_fd=r1, 0xf, 0x4, 0x81, 0x1, 0x5, r0}, 0x37)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/platform/dummy_hcd.5/usb6/6-0:1.0/usb6-port1/location\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000100)=""/188, 0xbc)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48402, 0x0)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0)
ioctl$auto(0x3, 0x400c4d01, r3)
statx$auto(0xffffffffffffffff, 0x0, 0xf2e1, 0xf, 0x0)
syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff)
write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000000300)="0000e3813213b2", 0x7)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
close_range$auto(0x2, 0x8, 0x0)
executing program 0:
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, 0x0, 0x20201, 0x0)
write$auto(0x3, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write$auto_kernfs_file_fops_kernfs_internal(r1, 0x0, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
syz_genetlink_get_family_id$auto_ovs_datapath(&(0x7f00000001c0), r0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x10b142, 0x0)
sendfile$auto(r2, r2, 0x0, 0x200)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
bpf$auto(0x0, 0x0, 0xa3)
close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x5)
socket(0x2, 0x1, 0x106)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x300, 0x0)
socket(0x2b, 0x6, 0x0)
sendmsg$auto_WG_CMD_GET_DEVICE(0xffffffffffffffff, 0x0, 0x20008000)
r3 = socket(0x3, 0x1, 0x6)
io_uring_setup$auto(0x7, &(0x7f0000000000)={0x10000, 0x80, 0xe, 0x8, 0x1fd, 0x4, r3, [0x7fffffff, 0x8, 0x6], {0x5, 0x800000a, 0x200, 0xffffffff, 0x81, 0x1ff, 0x7, 0x8, 0x200}, {0x1136400, 0x72, 0x1800000, 0x4, 0x8, 0x4, 0x3b72, 0x80, 0xffffffffffffffff}})
write$auto(0x3, 0x0, 0x3f00)
executing program 32:
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, 0x0, 0x20201, 0x0)
write$auto(0x3, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write$auto_kernfs_file_fops_kernfs_internal(r1, 0x0, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
syz_genetlink_get_family_id$auto_ovs_datapath(&(0x7f00000001c0), r0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x10b142, 0x0)
sendfile$auto(r2, r2, 0x0, 0x200)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
bpf$auto(0x0, 0x0, 0xa3)
close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x5)
socket(0x2, 0x1, 0x106)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x300, 0x0)
socket(0x2b, 0x6, 0x0)
sendmsg$auto_WG_CMD_GET_DEVICE(0xffffffffffffffff, 0x0, 0x20008000)
r3 = socket(0x3, 0x1, 0x6)
io_uring_setup$auto(0x7, &(0x7f0000000000)={0x10000, 0x80, 0xe, 0x8, 0x1fd, 0x4, r3, [0x7fffffff, 0x8, 0x6], {0x5, 0x800000a, 0x200, 0xffffffff, 0x81, 0x1ff, 0x7, 0x8, 0x200}, {0x1136400, 0x72, 0x1800000, 0x4, 0x8, 0x4, 0x3b72, 0x80, 0xffffffffffffffff}})
write$auto(0x3, 0x0, 0x3f00)
executing program 1:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
io_uring_setup$auto(0xa, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000380)='/sys/module/ima/parameters/ahash_bufsize\x00', 0x62, 0x0)
write$auto(r0, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
close_range$auto(0x2, 0xa, 0x0)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video63\x00', 0x80800, 0x0)
read$auto_v4l2_fops_v4l2_dev(r1, &(0x7f00000001c0)=""/191, 0x1f8)
getsockopt$auto_SO_TIMESTAMPING_NEW(r1, 0x4, 0x41, &(0x7f0000000000)='/proc/fs/ext4/sda1/mb_groups\x00', &(0x7f0000000080)=0x6772)
fcntl$auto(0x0, 0x407, 0x1)
open(0x0, 0xa240, 0x15e)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
fallocate$auto(0x8000000000000003, 0x0, 0xd, 0xcbd5d)
fallocate$auto(0x3, 0x3, 0x92d4, 0x7)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/ext4/sda1/mb_groups\x00', 0x10b402, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/pcrypt/pencrypt/serial_cpumask\x00', 0xa001, 0x0)
write$auto(r2, &(0x7f0000000040)=',\x00^\xa2\x02\x00\x00\x00\x00\x00\xd8l\x00\x00\x00\x00\x00\x00\xb2s\x83\xbd\xc5_%\xc1\xa3\xd0\x95Hq\xf4zG\x01[{\x17\x05I\xe0\xb1d)\x06z8L\xe6&[\xa9X6\x7f\xec\x94\xdal\xa1\xbb\x86\x9c\xc2\xef\x02\r9%\x06\xc5\'b%m_\x96A\"\xdd\xe40\xa7\xc3\x9ah\xf3B\xc2\xec\xf8\r\f[\xe5\x9dK\xe1\x99\x86\xfc\xac\x9f\x8a', 0x1000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$auto_SO_ATTACH_BPF(r3, 0x1, 0x32, &(0x7f0000000180)='/dev/mtd0\x00', 0x4)
arch_prctl$auto_ARCH_SHSTK_ENABLE(0x5001, 0x40)
open(0x0, 0x161342, 0x100)
executing program 1:
syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
ioctl$auto(r0, 0x4b40, 0xffffffffffffffff)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
statmount$auto(0x0, &(0x7f0000000180)={0x8000008, 0x1, 0x38a1, 0x3, 0x26, 0x940, 0x1ffde, 0x3, 0x6, 0x902c, 0x6, 0x400005, 0x3, 0x4, 0xb0, 0x8, 0x10000000009, 0x3, 0x5, 0x6, 0x8, 0xffffffff, 0x0, 0x0, 0x0, 0x0, [0x3, 0x3, 0x200000000, 0x400000000, 0x0, 0x3901, 0x0, 0x4, 0x3, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0xffffffeffffffffe, 0x4, 0x0, 0xceb, 0x7fffffff, 0xfffffffffffffffc, 0x0, 0x5, 0x96f, 0xffffffffffffffff, 0x2, 0x4001, 0x3, 0x0, 0x100b548, 0x8, 0x1, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x3]}, 0xfffff7fffffffffa, 0x81)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2c, 0x3, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
getsockopt$auto(0x6, 0x11b, 0x1, 0xfffffffffffffffe, 0x0)
read$auto(r1, 0x0, 0x20)
openat$auto_cachefiles_daemon_fops_internal(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001980)={0x3c, r3, 0x1b, 0x70bd26, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_PROBE={0x4}, @OVS_PACKET_ATTR_ACTIONS={0xc, 0x3, 0x0, 0x1, [@nested={0x8, 0x14, 0x0, 0x1, [@nested={0x4, 0x5}]}]}, @OVS_PACKET_ATTR_PACKET={0x12, 0x1, "898771f1c19f1779048590828847"}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r4 = openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/usb/usbmon/32u\x00', 0x0, 0x0)
socketcall$auto_SYS_RECVMSG(0x11, &(0x7f0000000040)=0x7f)
openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/usb/usbmon/10t\x00', 0x40, 0x0)
read$auto_mon_fops_text_t_mon_text(r4, 0x0, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
executing program 1:
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon26\x00', 0x40000, 0x0)
timerfd_create$auto(0x0, 0x0)
socket(0x2, 0x6, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/dummy_hcd.4/usb5/ep_00/wMaxPacketSize\x00', 0x8100, 0x0)
socket(0x25, 0x1, 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
socket(0xa, 0x3, 0x73)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
ioctl$auto(r0, 0x5423, 0x9)
executing program 4:
unshare$auto(0x40000080)
socket(0x1d, 0x2, 0x6)
openat$auto_fops_blob_file(0xffffffffffffff9c, &(0x7f0000011500), 0x40002, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ptyc9\x00', 0x20c40, 0x0)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080))
openat$auto_proc_mounts_operations_mnt_namespace(0xffffffffffffff9c, 0x0, 0x121080, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x40000c, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/block/loop9/queue/rotational\x00', 0x242401, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40d40, 0x1a0)
socket(0x10, 0x2, 0x14)
r0 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyaf\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
write$auto(0x3, 0x0, 0xffd8)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
semtimedop$auto(0x3, 0x0, 0x8, &(0x7f00000000c0)={0xf3c7, 0x5})
userfaultfd$auto(0x1)
read$auto(r0, &(0x7f0000000040)='/dev/ptyc9\x00', 0x9)
close_range$auto(0x2, 0x8, 0x0)
executing program 2:
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
mkdir$auto(&(0x7f00000000c0)='./file1\x00', 0x8)
signalfd$auto(0xffffffff, 0x0, 0x8)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1/file0\x00', 0x840, 0xc)
socket(0x1d, 0x2, 0x6)
socket(0x2, 0x2, 0x1)
io_uring_setup$auto(0x6, 0x0)
io_uring_setup$auto(0x6, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/009/001\x00', 0xa101, 0x0)
io_uring_setup$auto(0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x100480, 0x0)
socketpair$auto(0x4004, 0xf, 0x4, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
ioctl$auto_TCFLSH2(r0, 0x400455c8, 0x0)
set_mempolicy$auto(0x2, 0x0, 0x4)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
r2 = socket(0xa, 0x6, 0x0)
listen$auto(r2, 0x26da)
close_range$auto(0x2, r2, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
executing program 1:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
setgroups$auto(0xe32, 0x0)
ppoll$auto(0x0, 0x9, 0x0, 0x0, 0x8)
madvise$auto(0x0, 0x200007, 0x19)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x111, 0x2, 0x8000)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram14\x00', 0xe4242, 0x0)
close_range$auto(0x2, 0x8, 0x0)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000000), r1)
sendmsg$auto_ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x1, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000840}, 0x2000c840)
bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x4e23}, 0x67)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x2, 0xb}, 0x800009}, 0x5, 0x20000000)
mremap$auto(0x8000000000000004, 0x0, 0x401, 0xfffffffffffffffe, 0x1ffffffe)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
socket(0xa, 0x2, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x6, 0x0)
bpf$auto(0x0, 0x0, 0xfbf)
shutdown$auto(0x200000003, 0x2)
executing program 2:
r0 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000040), 0x1c8281, 0x0)
mmap$auto(0x0, 0x9, 0x3ff57697, 0x9b72, r0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{0x0, 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x5, 0x80009}, 0x7}, 0x101, 0x0)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x11f, 0x0, 0xfffffffffffffffd)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(r0, 0x0, 0x1)
connect$auto(0x3, 0x0, 0x51)
getrandom$auto(0x0, 0x6000000, 0x3)
socket(0x2, 0x1, 0x8000)
setsockopt$auto(0x3, 0x0, 0x22, 0x0, 0x28)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
ioctl$auto(r2, 0x5428, 0x7)
executing program 4:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
write$auto_fuse_dev_operations_fuse_i(0xffffffffffffffff, &(0x7f0000000440)="11000000126584", 0x7)
mmap$auto(0x0, 0x20007, 0x9, 0xeb1, 0x403, 0x8000)
kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x2aa7, 0x6c0000c000, 0xc000}, 0x4)
r0 = socket(0x2, 0x1, 0x0)
ioctl$auto_RTC_ALM_READ(0xffffffffffffffff, 0x80247008, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/midiC2D0\x00', 0x1e1001, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/009/001\x00', 0xa101, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x4, 0x15f4da0a, 0x1, 0x3, 0x1000000, 0x80000001, 0x7, 0x6d3c, 0x5, 0x2]}, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
faccessat2$auto(r0, &(0x7f0000000100)='./file1\x00', 0x3, 0x2)
madvise$auto(0x0, 0x7fffffffffffffff, 0xa)
futex$auto(&(0x7f0000000080)=0x3, 0xb, 0x1, 0x0, 0x0, 0xfffffffa)
mkdir$auto(&(0x7f0000000040)='./file0\x00', 0x2)
mknodat$auto(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0xfff, 0xfffffff8)
renameat2$auto(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000240)='./file1\x00', 0x1)
r2 = openat$dir(0xffffffffffffff9c, 0x0, 0x8000, 0x70)
mkdir$auto(&(0x7f0000000000)='./file0/file0\x00', 0x3)
renameat2$auto(r2, &(0x7f0000000200)='./file0\x00', r2, &(0x7f0000000240)='./file1\x00', 0x2)
r3 = openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000000)='/dev/usbmon8\x00', 0x881, 0x0)
ioctl$auto_MON_IOCX_GETX(r3, 0x4018920a, &(0x7f00000000c0)={0x0, 0x0, 0x4})
read$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffffff, &(0x7f0000001100)=""/4096, 0x1000)
executing program 2:
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram2\x00', 0x14f642, 0x0)
mmap$auto(0x7fff, 0x400008, 0xda, 0x9b72, 0x2, 0x480000000008001)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
getrandom$auto(0x0, 0x6000000, 0x3)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400020009, 0x10000000000df, 0x13, 0x8000000401, 0x7fffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
io_uring_setup$auto(0x6, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
memfd_create$auto(0x0, 0x9)
mmap$auto(0x0, 0x20009, 0x20004000000000df, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_DISASSOCIATE(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x8)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS0\x00', 0x1, 0x0)
write$auto(r1, 0x0, 0x5)
executing program 3:
socket(0x11, 0x3, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/usb/usbmon/9t\x00', 0x800, 0x0)
openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000980)='/proc/self/pagemap\x00', 0x188880, 0x0)
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000100)='/dev/usbmon20\x00', 0x40080, 0x0)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
mkdir$auto(&(0x7f00000000c0)='./file1\x00', 0x8)
signalfd$auto(0xffffffff, 0x0, 0x8)
openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x143000, 0x0)
socket(0x10, 0x3, 0xa)
socket(0x1d, 0x2, 0x6)
socket(0x2, 0x2, 0x1)
io_uring_setup$auto(0xfff, 0x0)
io_uring_setup$auto(0x6, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/009/001\x00', 0xa100, 0x0)
pipe$auto(0x0)
pipe$auto(0x0)
io_uring_setup$auto(0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
socketpair$auto(0x4004, 0xf, 0x4, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
ioctl$auto_TCFLSH2(r0, 0x540b, 0x0)
executing program 4:
r0 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000040), 0x1c8281, 0x0)
mmap$auto(0x0, 0x9, 0x3ff57697, 0x9b72, r0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
sendmmsg$auto(0x3, 0x0, 0x101, 0x0)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x11f, 0x0, 0xfffffffffffffffd)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(r0, 0x0, 0x1)
connect$auto(0x3, 0x0, 0x51)
getrandom$auto(0x0, 0x6000000, 0x3)
socket(0x2, 0x1, 0x8000)
setsockopt$auto(0x3, 0x0, 0x22, 0x0, 0x28)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
ioctl$auto(r2, 0x5428, 0x7)
executing program 3:
r0 = socket(0x10, 0x2, 0xf)
ioctl$auto___SNDRV_PCM_IOCTL_SYNC_PTR64(0xffffffffffffffff, 0xc0884123, &(0x7f0000000180)={0x1, 0x0, @reserved="8c0063afd519ee73a1991b704222e8acfcee74abf3682dc9a8783bd6424bb319e08e5c50f551e15e4efc5f05f5ce98f82ce29d7b5f908d12bad623e9627762bf", @control={{}, 0x6c, {}, {}, 0x8}})
r1 = bpf$auto(0x0, &(0x7f0000000080)=@bpf_attr_4={0x1e, <r2=>r0, 0xffffffff}, 0xd)
openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/extfrag/unusable_index\x00', 0x2, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x10000, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0xb6f3, 0x2, 0x100000001)
io_uring_setup$auto(0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0x4020ae76, 0x38)
socket(0x2b, 0x1, 0x1)
listen$auto(0x3, 0x83)
ioctl$auto(0x3, 0x541b, 0x38)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x2000040eb2, r2, 0x1)
r4 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x2001, 0x0)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/devices/virtual/mac80211_hwsim/hwsim1/ieee80211/phy1/rfkill3/soft\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000000080)=""/64, 0x40)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x20000411, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x7, 0x3)
membarrier$auto(0x2, 0x100000000, 0x8000000000000001)
ioctl$auto_USB_RAW_IOCTL_EPS_INFO(r4, 0x83c0550b, 0x0)
r6 = openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/pcmC0D0p\x00', 0x1a1280, 0x0)
ioctl$auto_SNDRV_PCM_IOCTL_PVERSION(r6, 0x80044100, 0x0)
bpf$auto(0x2, &(0x7f0000000080)=@iter_create={r1, 0x98}, 0x5)
executing program 3:
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon26\x00', 0x40000, 0x0)
timerfd_create$auto(0x0, 0x0)
socket(0x2, 0x6, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/dummy_hcd.4/usb5/ep_00/wMaxPacketSize\x00', 0x8100, 0x0)
socket(0x25, 0x1, 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
socket(0xa, 0x3, 0x73)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
ioctl$auto(r0, 0x5423, 0x9)
executing program 1:
r0 = socket(0x2, 0x5, 0x0)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000240), 0x40, 0x0)
getcwd$auto(0x0, 0xffffffffffffffff)
setsockopt$auto(0x3, 0x10000000084, 0x2, 0x0, 0x8)
futex$auto(&(0x7f0000000000)=0xf0fe, 0x5, 0x4, 0x0, &(0x7f0000000080)=0x9, 0x3000000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
io_cancel$auto(0x7, 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x1fff8}, 0x7, 0x0, 0x2, 0xb}, 0xfff}, 0x5, 0x311)
openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/pagemap\x00', 0x0, 0x0)
ioperm$auto(0x3, 0x8001, 0x2000000000000149)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mbind$auto(0x9, 0x84, 0x4, &(0x7f0000000000), 0x80000000, 0x7f)
socket(0xa, 0x2, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x6, 0x0)
shutdown$auto(0x200000003, 0x2)
sendmsg$auto_NLBL_MGMT_C_LISTDEF(0xffffffffffffffff, 0x0, 0x20048800)
unshare$auto(0x40000080)
recvmmsg$auto(0x3, 0x0, 0x687bcbd, 0x8, 0x0)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0x6, 0x8000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'})
r1 = fcntl$auto_F_UNLCK(0xffffffffffffffff, 0x80000001, 0x2)
ioctl$auto__ctl_fops_dm_ioctl(r1, 0x5, &(0x7f0000000300)="45195a192c1cba299d214d93530d8173bbd8885d68522857a9db119cf4e5447129346f95ab5438d27cfa4c0970559bcc5a0d974c1005ff567a0d7841789654a0dbd777af384803c1f98654")
read$auto(r0, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
socket(0x10, 0x2, 0xf)
mmap$auto(0x0, 0xc, 0xfff, 0x44eb2, 0x10006, 0x300000000000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x40000, 0x0)
r3 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/stack\x00', 0x181100, 0x0)
read$auto_proc_single_file_operations_base(r3, &(0x7f0000000080)=""/112, 0x70)
r4 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bus/usb/009/001\x00', 0x103181, 0x0)
ioctl$auto(r4, 0x802c550a, 0x1)
shutdown$auto(r4, 0x5)
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00')
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
setresuid$auto(0x8, 0x8, 0x0)
setfsuid$auto(0x0)
r5 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sda\x00', 0x8001, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$auto_psample(&(0x7f0000007a40), 0xffffffffffffffff)
sendmsg$auto_PSAMPLE_CMD_GET_GROUP(r6, &(0x7f0000007b00)={0x0, 0x0, &(0x7f0000007ac0)={&(0x7f0000007a80)={0x14, r7, 0x311, 0x70bd29, 0x25dfdbfe}, 0x14}}, 0x0)
ioctl$auto(r5, 0x401070cd, 0x5)
executing program 3:
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
socket(0x11, 0x80003, 0x300)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm1p/sub2/xrun_injection\x00', 0x4a040, 0x0)
syz_genetlink_get_family_id$auto_ovs_flow(0x0, 0xffffffffffffffff)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfd, 0x8000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS3\x00', 0x0, 0x0)
move_pages$auto(0x1, 0x233, 0x0, 0x0, 0x0, 0x8000000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x3, 0x3b)
read$auto(0x3, 0x0, 0x80)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x3, 0xb, 0x5, 0x1ffde, 0x3, 0x6, 0x2, 0x9, 0x5, 0x3, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb2, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x2]}, 0x1fe, 0x81)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x8)
executing program 2:
mq_open$auto(&(0x7f0000000280)='\\*)A\x00', 0x7e, 0x9, 0x0)
r0 = socket(0x2b, 0x1, 0x1)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/trace_pipe\x00', 0x2000, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="0300ffffffe6", @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x40014}, 0x80)
r1 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, 0x0, 0x200, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r1, 0x6f29, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0x42, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/midiC2D3\x00', 0x2001, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000380)={[0x1ff, 0xd5b, 0xc, 0x9, 0x948a, 0x2, 0x15f6da08, 0xfffffffffffffffe, 0x3, 0x300000000000600, 0x40080000001, 0x7, 0x6d3c, 0x6, 0x9]}, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r3 = io_uring_setup$auto(0x6, 0x0)
setsockopt$auto(0x3, 0x1, 0xf, 0x0, 0x9)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_wireguard(0x0, r4)
r5 = open(0x0, 0x261c2, 0x84)
ftruncate$auto(r5, 0xa0)
lseek$auto(0x3, 0x2, 0x4)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_NETDEV_CMD_PAGE_POOL_GET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x48040}, 0x4000)
connect$auto(0x3, 0x0, 0x55)
socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000040)={0x1, 0x0, 0x36, 0x828, 0x9, 0x8000000000000000, 0x9f, 0x7, 0x9, 0x8, 0x2, 0x9, 0x3, 0x10000000000008, 0x0, 0x200000000000f, 0x100, 0x40000001, 0x10001, 0x2cf8, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4]}, 0xe3c, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x40}, 0x40000)
executing program 3:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$auto_sc_seq_fops_netdebug(0xffffffffffffff9c, &(0x7f0000000040), 0x88080, 0x0)
io_uring_setup$auto(0x59, &(0x7f0000000080)={0x1, 0xd, 0x3000, 0x5, 0x4, 0x7fffffff, r0, [], {0x6, 0x6, 0x3b5a, 0x21f, 0x102, 0x7ffffffb, 0x101, 0x8, 0x3}, {0x100, 0x1, 0x52, 0x405, 0x2, 0x60, 0x76c5, 0x8, 0x100000000}})
unshare$auto(0x40000080)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x202002, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x2, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x4, 0x2, 0x15f4da0a, 0x1, 0x7fff, 0x300000000000000, 0x80000001, 0xdc, 0x6d3c, 0x0, 0x2, 0x2e]}, 0x0)
close_range$auto(0x2, 0x8, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x8002, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x80805, 0x0)
eventfd$auto(0x7)
select$auto(0x5, 0x0, 0x0, &(0x7f00000001c0)={[0x1aa57c94, 0x95, 0x5, 0x100000003, 0x8475, 0x6, 0x1, 0x9, 0xec, 0x2, 0x8, 0x8, 0x5, 0x7]}, 0x0)
writev$auto(0x4, &(0x7f0000000080)={&(0x7f0000000040), 0x8}, 0x1)
r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0)
write$auto(r2, 0x0, 0xb6)
write$auto(0x3, 0x0, 0xffd8)
r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f00000000c0), r1)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000380)={0x200, r3, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@HWSIM_ATTR_IFTYPE_SUPPORT={0x8, 0x17, 0xbbcd}, @HWSIM_ATTR_ADDR_TRANSMITTER={0xdb, 0x2, "3f26e894fe582c3657357d6374fd299cbbc666c087594dcce58ed932154acf492c6d3474be04da758e57a84a83e818053b6652ea0a4a0a919b0c4420c4b16ec10be2fbfb78134f4af65e97d48caab13fe71dddeeb9601348ca1f24d4c3466c62f6f1ee76103af5b3943c57ede5603ad0b630c347f2b7bea62cb4a9c9e290c55279fd407c2c7b8884fcb7d27e62c4ce685838124a6ee9987190b0edf906b1ed96206eaecad0c2206f2ee876b8d492c34fb3e04a91362a75b43bf7d8dcfa9cb72219db4ed5d7286dda92f75efdf845023979836fc9746a72"}, @HWSIM_ATTR_CHANNELS={0x8, 0x9, 0x9}, @HWSIM_ATTR_PERM_ADDR={0x100, 0x16, "357d4b4548f177753c1e703e04063e1563683e95cf5f00f6e8a0f75922475d2ab852dd3b92b354a8772419f4a1ae0bbd6bb23fd47dffb42628d8bf77b4a4f2ec4f63c4327a6c77a5b3d1e17e00f3b643664a1ab151b76cdf90853427413f6f960086481dab8b80f1ad3e828dde4f42cf47f1401162b4e5c6fefa1de94e7e437df22298832a88c9dc2679ffe17a959d2e232ca10523e26c94a758eec164c35e154639e028eddb7cf97ecf2ad136b893b8a7b3151185d2c597a054cee75dd9383336552c9a2309b9dcc59d184b7ccc76c121959a7beee73560f9dea4f2ae004658f2239897f402e52338a1469c509ee86997c3202f1332b80f4266a655"}]}, 0x200}}, 0x80)
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0x80401, 0x0)
writev$auto(0x3, &(0x7f0000000100)={&(0x7f0000000340), 0x7111}, 0x8)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x200, 0x0)
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000040))
r2 = socket(0x15, 0x5, 0x0)
sendmsg$auto_NL80211_CMD_SET_TID_TO_LINK_MAPPING(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40040}, 0x4008010)
sched_setscheduler$auto(0x0, 0x8, &(0x7f0000000000)={0xfff})
fcntl$auto(r1, 0x402, 0x2)
sync_file_range$auto(r2, 0x9, 0xffffffffffff98b5, 0x5)
fcntl$auto(r1, 0x402, 0x0)
mmap$auto(0x7, 0x20009, 0x3, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x80091, 0x0)
writev$auto(r3, &(0x7f0000000000)={0x0, 0x710d}, 0x8000000000000001)
pread64$auto(r0, 0x0, 0x3f, 0x20007fff)
socket$nl_generic(0x10, 0x3, 0x10)
ioperm$auto(0x7, 0x6, 0x2)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0x7fffffffffffffff, 0xa)
r4 = open(&(0x7f00000000c0)='./cgroup\x00', 0x0, 0xb5d1af1605322df2)
syz_clone3(&(0x7f0000000200)={0x383281180, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/fs/cifs/smbd_max_send_size\x00', 0x2200, 0x0)
sendmsg$auto_NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x2404c800)
kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x800c000, 0x40000000, 0x800c000}, 0x4)
executing program 4:
set_mempolicy$auto(0x6, 0x0, 0x4)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x200006, 0x2, 0x40eb1, 0x602, 0x300000000000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_enter$auto(0x3, 0x1, 0x82400001, 0x0, 0x0, 0x18)
mmap$auto(0x0, 0x9, 0xdf, 0x1000000eb1, 0x401, 0x8000)
mknod$auto(0x0, 0x1081, 0x3)
close_range$auto(0x2, 0x8, 0x0)
creat$auto(0x0, 0x4)
creat$auto(0x0, 0x9)
open(0x0, 0x22242, 0x155)
setsockopt$auto(0xffffffffffffffff, 0x107, 0x9, 0x0, 0x6)
close_range$auto(0x2, 0x8, 0x0)
migrate_pages$auto(0xffffffffffffffff, 0x8, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
write$auto(0x3, 0x0, 0xfffffdef)
ioctl$auto(0x3, 0x5412, 0x38)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
ioctl$auto(0xffffffffffffffff, 0x8004510b, 0x3)
ioctl$auto__ctl_fops_dm_ioctl(0xffffffffffffffff, 0xfffffffffffffd02, &(0x7f00000001c0))
madvise$auto(0x110c230000, 0x8031ca, 0x9)
executing program 3:
socket(0xa, 0x3, 0x3a)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000003340)='/dev/sg0\x00', 0x202, 0x0)
write$auto_sg_fops_sg(r1, &(0x7f0000003380)="b25b1a8c398ef400dbcbc7a996eea7f3804ca6c7591adef6578d2f5f520f687f316ba7329774c854d58309037c0ae2ae6eb53b1d", 0x34)
sendmsg$auto_NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4004080}, 0x20040894)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
clock_gettime$auto(0x9, &(0x7f0000000000)={0x7, 0xb})
read$auto(0x3, 0x0, 0x80)
close_range$auto(0x2, 0xa, 0x0)
socket(0x18, 0xa, 0x1)
socket(0xa, 0x2, 0x0)
connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r2, 0x29, 0x1f, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_uprobe_events_ops_trace_uprobe(0xffffffffffffff9c, 0x0, 0x302, 0x0)
executing program 1:
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram2\x00', 0x14f642, 0x0)
mmap$auto(0x7fff, 0x400008, 0xda, 0x9b72, 0x2, 0x480000000008001)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
getrandom$auto(0x0, 0x6000000, 0x3)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400020009, 0x10000000000df, 0x13, 0x8000000401, 0x7fffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
io_uring_setup$auto(0x6, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000)
memfd_create$auto(0x0, 0x9)
mmap$auto(0x0, 0x20009, 0x20004000000000df, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_DISASSOCIATE(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x8)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS0\x00', 0x1, 0x0)
write$auto(r1, 0x0, 0x5)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
sendmsg$auto_NL80211_CMD_ABORT_SCAN(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x4008010)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
r1 = openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/buffer_size_kb\x00', 0x40, 0x0)
readv$auto(r1, &(0x7f0000000100)={0x0, 0x3}, 0x1)
read$auto(r0, 0x0, 0x6)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, 0x0, 0x802, 0x0)
writev$auto(r2, 0x0, 0x3)
mmap$auto(0x2000000, 0x2020009, 0x3, 0xeb1, 0xffff7ffffffffffa, 0x7fff)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101181, 0x0)
mmap$auto(0x0, 0x6, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mq_open$auto(&(0x7f0000000000)='.\xf1e4\xdf\x16\x95kxE\xd9x\x15\xb0\xf6V\x93\xb4E\x06\xc5}l', 0x400056a, 0x9, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0x8070ae9f, 0xffffffffffffffff)
timerfd_create$auto(0x9, 0x0)
openat$auto_tracing_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/per_cpu/cpu1/trace\x00', 0x1a6b75d63882a712, 0x0)
write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)
socket(0x23, 0x1, 0x2)
close_range$auto(0x2, 0x8000, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG-socket-bind$auto-socket-close_range$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)
socket(0x23, 0x1, 0x2)
close_range$auto(0x2, 0x8000, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
single: successfully extracted reproducer
found reproducer with 25 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG-socket-bind$auto-socket
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)
socket(0x23, 0x1, 0x2)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG-socket-bind$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)
bind$auto(0x3, 0x0, 0x6b)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG-socket
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)
socket(0x10, 0x2, 0xc)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO-sendmsg$auto_NL80211_CMD_GET_REG
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4001)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim-sendmsg$auto_HWSIM_CMD_NEW_RADIO
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE={0x4}, @HWSIM_ATTR_REG_CUSTOM_REG={0x8, 0xc, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_mac80211_hwsim
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto-socket$nl_generic
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
socket$nl_generic(0x10, 0x3, 0x10)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev-sendmmsg$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto-openat$auto_mousedev_fops_mousedev
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x1a1382, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io-ioctl$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)
ioctl$auto(r3, 0x560a, 0x7)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto-openat$auto_tty_fops_tty_io
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev-close_range$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)
close_range$auto(0x2, 0x8, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev-read$auto_v4l2_fops_v4l2_dev
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)
read$auto_v4l2_fops_v4l2_dev(r2, &(0x7f0000000080)=""/27, 0x1b)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto-openat$auto_v4l2_fops_v4l2_dev
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/radio6\x00', 0x8a240, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto-getsockopt$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0xa, 0x1, 0x84)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r1, 0x0, 0xe)
getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0xa, 0x1, 0x84)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-openat$auto_fb_fops_fb_chrdev
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0xa, 0x1, 0x84)
openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x2000, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0xa, 0x1, 0x84)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-socket-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0xa, 0x1, 0x84)
write$auto(0xffffffffffffffff, 0x0, 0xe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-syz_genetlink_get_family_id$auto_netdev-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
syz_genetlink_get_family_id$auto_netdev(&(0x7f00000000c0), 0xffffffffffffffff)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-socket-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
socket(0xa, 0x801, 0x84)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-map_shadow_stack$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
map_shadow_stack$auto(0x2, 0x3, 0x1)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioperm$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioperm$auto(0x7, 0x6, 0xffffffffffff4064)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
reproducing took 1h50m45.879444037s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
Read of size 8 at addr ffff888029663800 by task syz.0.616/6721

CPU: 1 UID: 0 PID: 6721 Comm: syz.0.616 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xd9/0x110 mm/kasan/report.c:634
 force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
 full_proxy_write+0x13c/0x200 fs/debugfs/file.c:398
 vfs_write+0x24c/0x1150 fs/read_write.c:677
 ksys_write+0x12b/0x250 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff48518d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff150e3048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff4853a5fa0 RCX: 00007ff48518d169
RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ff48520e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff4853a5fa0 R14: 00007ff4853a5fa0 R15: 0000000000000003
 </TASK>

Allocated by task 5964:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 vhci_open+0x4c/0x430 drivers/bluetooth/hci_vhci.c:634
 misc_open+0x35a/0x420 drivers/char/misc.c:179
 chrdev_open+0x237/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x735/0x1c40 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3830 [inline]
 path_openat+0x1e88/0x2d80 fs/namei.c:3989
 do_filp_open+0x20c/0x470 fs/namei.c:4016
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428
 do_sys_open fs/open.c:1443 [inline]
 __do_sys_openat fs/open.c:1459 [inline]
 __se_sys_openat fs/open.c:1454 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1454
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5964:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kfree+0x2c4/0x4d0 mm/slub.c:4757
 vhci_release+0xbb/0xf0 drivers/bluetooth/hci_vhci.c:670
 __fput+0x3ff/0xb70 fs/file_table.c:464
 task_work_run+0x14e/0x250 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xad8/0x2d70 kernel/exit.c:938
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x24ed/0x26c0 kernel/signal.c:3036
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888029663800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff888029663800, ffff888029663c00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29660
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000a59801 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5634, tgid 5634 (dhcpcd), ts 43550917890, free_ts 43547424451
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2587 [inline]
 new_slab+0x23d/0x330 mm/slub.c:2640
 ___slab_alloc+0xc5d/0x1720 mm/slub.c:3826
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3916
 __slab_alloc_node mm/slub.c:3991 [inline]
 slab_alloc_node mm/slub.c:4152 [inline]
 __do_kmalloc_node mm/slub.c:4293 [inline]
 __kmalloc_node_noprof+0x2f0/0x510 mm/slub.c:4300
 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:662
 bpf_jit_binary_pack_alloc+0xc1/0x290 kernel/bpf/core.c:1159
 bpf_int_jit_compile+0x575/0x1830 arch/x86/net/bpf_jit_comp.c:3555
 bpf_prog_select_runtime+0x32a/0x4c0 kernel/bpf/core.c:2428
 bpf_migrate_filter net/core/filter.c:1307 [inline]
 bpf_prepare_filter+0xd3d/0x1100 net/core/filter.c:1355
 bpf_prog_create_from_user+0x1e4/0x2d0 net/core/filter.c:1449
 seccomp_prepare_filter kernel/seccomp.c:693 [inline]
 seccomp_prepare_user_filter kernel/seccomp.c:730 [inline]
 seccomp_set_mode_filter kernel/seccomp.c:1965 [inline]
 do_seccomp+0x7b6/0x2640 kernel/seccomp.c:2085
 prctl_set_seccomp+0x4b/0x70 kernel/seccomp.c:2138
page last free pid 5502 tgid 5502 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 __put_partials+0x14c/0x170 mm/slub.c:3153
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4115 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 kmem_cache_alloc_node_noprof+0x223/0x3c0 mm/slub.c:4216
 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:596
 alloc_skb include/linux/skbuff.h:1331 [inline]
 alloc_skb_with_frags+0xe4/0x850 net/core/skbuff.c:6522
 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2897
 unix_dgram_sendmsg+0x45e/0x18c0 net/unix/af_unix.c:2017
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:733 [inline]
 sock_write_iter+0x4fe/0x5b0 net/socket.c:1137
 do_iter_readv_writev+0x655/0x950 fs/read_write.c:820
 vfs_writev+0x363/0xdd0 fs/read_write.c:1050
 do_writev+0x297/0x340 fs/read_write.c:1096
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888029663700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888029663780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888029663800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888029663880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888029663900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
Read of size 8 at addr ffff888029663800 by task syz.0.616/6721

CPU: 1 UID: 0 PID: 6721 Comm: syz.0.616 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xd9/0x110 mm/kasan/report.c:634
 force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
 full_proxy_write+0x13c/0x200 fs/debugfs/file.c:398
 vfs_write+0x24c/0x1150 fs/read_write.c:677
 ksys_write+0x12b/0x250 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff48518d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff150e3048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff4853a5fa0 RCX: 00007ff48518d169
RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ff48520e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff4853a5fa0 R14: 00007ff4853a5fa0 R15: 0000000000000003
 </TASK>

Allocated by task 5964:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 vhci_open+0x4c/0x430 drivers/bluetooth/hci_vhci.c:634
 misc_open+0x35a/0x420 drivers/char/misc.c:179
 chrdev_open+0x237/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x735/0x1c40 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3830 [inline]
 path_openat+0x1e88/0x2d80 fs/namei.c:3989
 do_filp_open+0x20c/0x470 fs/namei.c:4016
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428
 do_sys_open fs/open.c:1443 [inline]
 __do_sys_openat fs/open.c:1459 [inline]
 __se_sys_openat fs/open.c:1454 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1454
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5964:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kfree+0x2c4/0x4d0 mm/slub.c:4757
 vhci_release+0xbb/0xf0 drivers/bluetooth/hci_vhci.c:670
 __fput+0x3ff/0xb70 fs/file_table.c:464
 task_work_run+0x14e/0x250 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xad8/0x2d70 kernel/exit.c:938
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x24ed/0x26c0 kernel/signal.c:3036
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888029663800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff888029663800, ffff888029663c00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29660
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000a59801 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5634, tgid 5634 (dhcpcd), ts 43550917890, free_ts 43547424451
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2587 [inline]
 new_slab+0x23d/0x330 mm/slub.c:2640
 ___slab_alloc+0xc5d/0x1720 mm/slub.c:3826
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3916
 __slab_alloc_node mm/slub.c:3991 [inline]
 slab_alloc_node mm/slub.c:4152 [inline]
 __do_kmalloc_node mm/slub.c:4293 [inline]
 __kmalloc_node_noprof+0x2f0/0x510 mm/slub.c:4300
 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:662
 bpf_jit_binary_pack_alloc+0xc1/0x290 kernel/bpf/core.c:1159
 bpf_int_jit_compile+0x575/0x1830 arch/x86/net/bpf_jit_comp.c:3555
 bpf_prog_select_runtime+0x32a/0x4c0 kernel/bpf/core.c:2428
 bpf_migrate_filter net/core/filter.c:1307 [inline]
 bpf_prepare_filter+0xd3d/0x1100 net/core/filter.c:1355
 bpf_prog_create_from_user+0x1e4/0x2d0 net/core/filter.c:1449
 seccomp_prepare_filter kernel/seccomp.c:693 [inline]
 seccomp_prepare_user_filter kernel/seccomp.c:730 [inline]
 seccomp_set_mode_filter kernel/seccomp.c:1965 [inline]
 do_seccomp+0x7b6/0x2640 kernel/seccomp.c:2085
 prctl_set_seccomp+0x4b/0x70 kernel/seccomp.c:2138
page last free pid 5502 tgid 5502 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 __put_partials+0x14c/0x170 mm/slub.c:3153
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4115 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 kmem_cache_alloc_node_noprof+0x223/0x3c0 mm/slub.c:4216
 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:596
 alloc_skb include/linux/skbuff.h:1331 [inline]
 alloc_skb_with_frags+0xe4/0x850 net/core/skbuff.c:6522
 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2897
 unix_dgram_sendmsg+0x45e/0x18c0 net/unix/af_unix.c:2017
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:733 [inline]
 sock_write_iter+0x4fe/0x5b0 net/socket.c:1137
 do_iter_readv_writev+0x655/0x950 fs/read_write.c:820
 vfs_writev+0x363/0xdd0 fs/read_write.c:1050
 do_writev+0x297/0x340 fs/read_write.c:1096
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888029663700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888029663780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888029663800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888029663880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888029663900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================