Extracting prog: 17m9.312509358s Minimizing prog: 1h14m44.122532752s Simplifying prog options: 0s Extracting C: 59.404085589s Simplifying C: 15m13.308078188s extracting reproducer from 24 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usbip_server_init-socket$inet6-setsockopt$inet6_int-connect$inet6-socket$nl_audit-socket$kcm-socket$kcm-socket$kcm-ioctl$sock_SIOCETHTOOL-ioctl$sock_kcm_SIOCKCMCLONE-socket$kcm-ioctl$sock_kcm_SIOCKCMCLONE-ioctl$sock_kcm_SIOCKCMCLONE-ioctl$sock_SIOCETHTOOL-openat$vimc1-ioctl$VIDIOC_SUBSCRIBE_EVENT-socket$kcm-recvmsg$kcm-write$usbip_server detailed listing: executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = socket$kcm(0xa, 0x1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r5, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000000)=@ethtool_rxnfc={0x2a, 0x2, 0x6, {0xb, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @hdata="21ec713e6eeb076f1069460b0eda6bfa11b9c12001a61a09c12c0abba0298de9126a5918f5ab3bdaf8af26dee292ad9cdb394851", {0x0, @empty, 0x6, 0x5, [0x6, 0x9]}, 0xff, 0x2}}}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8916, &(0x7f0000000000)={r3}) r6 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x8916, &(0x7f0000000000)={r6}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8936, &(0x7f0000000000)={r6}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'nr0\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x1}}) r7 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000180)={0x3}) r8 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg$kcm(r8, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64=r7, @ANYRES64=r7, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$printer-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000240)={0x40, 0xe, 0x52, "2761cc415ac1b8ad5be7fce9aed2538b445321fcd836d0da6054ac60f06d6b69017839ec8f54b2240386536d0aaa2768d077cd8813da7dd6d385027b6fd534459fbea274b6ba2667385fc3ff151e65e93c55"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 8, 2, 11, 5, 1, 7, 6, 8, 10, 2, 3, 9, 23, 4, 9, 13, 11, 14, 4, 8, 28, 17, 19] detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xf}}}, 0x58}}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x25dfdbfc, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_COALESCE(r7, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x20000000) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000140)=0x8, 0x4) connect$inet(r5, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, &(0x7f0000004240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001800)="e9d7b200bf6ecf325e1a9c0dccd8c357998ad687717f392aab546e2ad010fb16c3120d5c20a62654dfa7da737faea449d323a40f6b39ce3ccea07331a90678979abfde57efde701f4c14b7897b8ef0530b2eecee7536d3c0186c646980b6c78eaf6f4d9d55d211f1d5a38fe9f95f95e72127a07b02bd5f5b3bcb265680ae107e6cf387fb56fca7ecd4e7257f1dc5a9ac14a40036a3f8675e691f6f6e9067617ffa6045157cf5b7562f68838b5e13843d24469663f76355633256edfdebaeee1320c3303b3d6a06113505045fb3ec9be769234a276ebec1707dae5cde", 0xdc}], 0x1}}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001ac0)="6c5b0b3e474f01bac640e7eb9064ec8e2ccac8b36c7d9ab464dc0bd7221bbae89e38ef0efc78f3e2f90e6236ad1ad1fb3dbd3e4fd8f2de84e526dfafb354837ff3958d97c8366471850ce9c14b83bb6e9a7c282a1d3e03cdfb675b61e1dbacc6ebcd08e105d4df684f2cd13262d10ffb8b0794f39b3e490416530423da29406a6a4b5a356dc898052883f1e54fd041e5a82247a4bbb784ce30ce321a2805b28d308a12c659df7f1d8ba12b3ac50605cda86b262fc1d8", 0xb6}, {&(0x7f0000001b80)="66a7d24b8451d3e0201a73aaabe1e3fe371dfbf029efdbc2de3742c687d72207cab9988bc15b9e27135be8e1d84bbeb01ccf943eb163a18b6a02c752c829c5f24ccd2c02f1c208e64deb4d916ff1727fe172cb09868b90", 0x57}, {&(0x7f0000001c00)="811e3e8966b4199496dc8329eca81fa24aedba0078949553b10b0df3cc25de83324cb3fb6672cbb763e260abad0adca5", 0x30}], 0x3}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000002f00)="5f97b46d7adb8b68ff35da0f147fef1c6c6c60db5c1fb54496a27c9eeb14cf97ceed1ac5e9d95d093d6400f4996e3c5f73fa7edad49015f697bdc1a17f731cd7b4e404954a2fbc069f73e9fa86cab27babb16a9004571326e20d84cb662973ba616c4ba4126e45ad1a7230b6c86c600a3dd01872c0f5823fadc0eb8b73f3d98c63881cd2131d63411f51e40a122182507d2d4be44f5fdec44f415e3448ebda832a6831bbd48324e11fe96400d92fae40f4a9ed9f376c56e6c6c703fe76dac9c3b4aed05a81b2b2adadc3e2ba8fd5cfc361420e61014782eeb5a921fd042bdc9cbfff5dac3df5711d5710e1d0a11d6e637dddd79ccd700dbc4924e22f8a50f0f43b6082b706c748e6d552178aa8d5959d8a3a175bf1d2b61b363fbad94b53505fb7ac302a0dec14a19141120d958b484f6e5e6f087267680eecfc91d11295a6bbd062cb7c99299681481a9ee65f157852aa46b21936e52611dbd9a8019b7566ec79b5fe8db94259c20842af9384aaf33dfafd15bb97d051743f467399caa4ee74394664c3de94449b4597bb90787c75a468f320be5e8faa11d13b589231eca2f9f4072cd44f0a1cbc874233a71901f5e027fc301caeadbe77f76206257f006e483b6b78b9319b57399a0f736f01df368726ee362c6224aaef36cff42bf221a2e03fb153bcdc240b594b22a043adc163f9004ed1ef0f152f0d960a58a18d709236df500abd672436b916c67c7e6fe7508530fe05b040c7cbeb2645f43259f3a142583a3051ea146281b901f732ba819f84050007c5f07e3848ddb7de602171525c7df8427475137a845796f12214b69dc7fb8cd458e9f2fac518b9dc84da1a13d8e95eb32cf4c14d2647b6e8bd808a91d258da905bac6e87ef6485e19ba85442c12b15c2fe95f5da8fd93f3b0c080703626eb7213954f38bdb5806393b0394532a886d896bed1b964984ba35de5de4674eab5e97312b6331fec90b0e9ad08cbb564d73a0428af45ad9ea2719cf92df0aab1853dd38afb3db05f9869be763db6b990f43c04a4ac665ca401bda074d7571200e8a96a21cbae95a9baa57e82e88458d623209a67334f64ef7fa0a32d13cb086dfccef412abe0afc8019c5f25939aa053301588663f27479ae0900830729b70385679b32996d02182adafefb5e961e5f8362ad44bb619b9059bf877f7e8fd5cf39549410e482d0c3a83ac67b7304aad8277d43da1f31d8d017304384596fb79d1201baa4feabdd8365028f3410d1e9497f88049e47c110193176927726f0a3b0209a1d3566fd04c68b6a114ea2aec2d3c43a34ba63eb75d3f6f7ed98517be6fd703b87bf50132d72222dbcd153c3d0e104a9ec507385263940799f9244c3c9b653622f3813dc689a205dc1e473815443f27d17bccdf34e219db5161364d97fd48d2f011fdaf5d7370698ad0cf3f06f66273a5fe6ad3877719dce5170e923686d89924eb85332acedb1fd208a323f84ecf2588621dd82f7a50bf489c6d28fc1d1f36a2ebbab0de2aa49a335f2a5aa09f7b5d8237757a4c74e3bca1eabbdc18f1ead5551bc59eb6f319ab16015f010c6b41f4412fc351b3be68a25b93663c389dbd72d2e84a2eb1dfe150b639d78fbb210d74352a4b8612c96845d3549b5b055ef4a864ef51c800aedd00fd7b3e8794c20a8630e9349e1825b5d7c8d25043f75be6098921eac5eb08e8dd27bc7b36453cf5c23687c809d3a74280beb3c5ce59629bb950499bffb758abe221447e78785f4cc1661c4", 0x4e4}], 0x1}}], 0x4, 0x40000) executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000100)) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000840)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x121000, 0x0) ioctl$TIOCGICOUNT(r3, 0x545d, 0x200000000000000) executing program 2: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x3, &(0x7f0000000000)=0x1, 0x1ff, 0x3) r0 = syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) process_vm_writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000280)=""/248, 0xf8}], 0x1, &(0x7f0000000480)=[{&(0x7f00000021c0)=""/4096, 0x1000}], 0x1, 0x0) executing program 0: syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0406"], 0xf) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000a00), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f00000002c0)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x5090880b, 0x0, 0x10, 0xd, 0x40, 0x0, 0x0, 0x2f, 0x1}}, 0x50) setxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', &(0x7f0000000100)={{}, {0x1, 0x4}, [], {0x4, 0x6}, [], {0x10, 0x1}, {0x20, 0x3}}, 0x24, 0x3) umount2(0x0, 0x9) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x826, 0x0, 0x0) executing program 0: r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) r2 = openat$binfmt(0xffffffffffffff9c, r0, 0x2, 0x0) close(r2) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f00000004c0)={[&(0x7f0000000000)='\x00', &(0x7f00000003c0)=')!}\x00']}, 0x0, 0x1000) executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) accept(r0, 0x0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a40)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x0) executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0xfffffffffffffffe) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x14, r1, 0x50dc85624ea6cf59, 0x0, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x400c081}, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x30, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x99}]}, 0x30}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_KEY(r1, 0x0, 0x8) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000240)={0x40, 0xe, 0x52, "2761cc415ac1b8ad5be7fce9aed2538b445321fcd836d0da6054ac60f06d6b69017839ec8f54b2240386536d0aaa2768d077cd8813da7dd6d385027b6fd534459fbea274b6ba2667385fc3ff151e65e93c55"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) executing program 3: r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100003d2ab420720c0d009b27010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000680)={0x1c, &(0x7f0000000580)={0x0, 0xd}, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000140)={0x0, 0xe}, 0x0, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000280)={0x20, 0x0, 0xe8, {0xe6, "04faf1e73a503cab713537c46cedd80c80b94e455084127ef73500ca4e8695337887295bb5593978e2edb0ab40a29f0bc5b7b877a5585480cb367c61b5baa18ac3c26ba49e10ca6eedcecd975a80cf714920c8e42f1b9f3313c5d845ae91ffea166f1843102afb976cc0c4da098145301c533c03f335472825d298464e8f1dbae30ed8baded436268287621e8246e1c2dae9728c783d80ea3597edf6fdb57d358ac16398a6a5c58b274f4783961bc90422f5eed7777313240e2716bd0aa6e003a54ee7a71022f78ccfe41c123ae9daf10073cfff49d538ade45476645ccd581f7cb1b14ed545"}}, &(0x7f0000000380)={0x20, 0x1, 0x1, 0x81}, &(0x7f00000003c0)={0x20, 0x0, 0x1, 0x8}}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f00000007c0)={0x20, 0x16}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: sendmmsg$nfc_llcp(0xffffffffffffffff, &(0x7f0000002d00)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000002c0)="1b", 0x1}], 0x1, 0x0, 0x0, 0x44084}], 0x1, 0x800) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x121002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0xf2, 0x5, 0x0, '\x00', 0x8001}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000070, 0x0, 0x1ff}]}) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, &(0x7f0000000000)) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000005c0)={[0x5836, 0x8, 0x7, 0x4000000000000e52, 0x1, 0x5479, 0x1041, 0x200000000006, 0xfffffffffffffffd, 0x1, 0xfffffffffffffffe, 0x100000000, 0x1, 0x40000000009, 0x8000000000005, 0x10000800040068], 0xd000, 0x80}) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaaaa10"], 0x1a) executing program 1: r0 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg$kcm(r0, &(0x7f0000006480)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000034c0)=""/4108, 0x100c}, {0x0}, {&(0x7f00000024c0)=""/4080, 0xff0}, {&(0x7f0000000b80)=""/66, 0x42}, {&(0x7f00000002c0)=""/35, 0x23}], 0x5}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r1, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_GET_LOW_DMA(r2, 0x227a, &(0x7f0000000100)) setreuid(0xffffffffffffffff, 0xee01) write$sndseq(r2, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029ea69801d76ab0a272a2a788bab6c95f79725074", 0x1c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x10060, 0x0) executing program 2: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109005000118049e1002100c9a7befe6f6d645a1a11b81b2c4b100fd57c06db1a75df432a9ed32d3b475663c0d236fd000000000000000000000000000000267f49eb82b962d81db29f0b47df47351f"], 0x184}}, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000bc0)={'filter\x00', 0x7, 0x4, 0x3b8, 0x20, 0x1e8, 0x1e8, 0x2d0, 0x2d0, 0x1e8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x100}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x44, 0x2, {0xffffffffffffe8d8}}}}, {{@arp={@remote, @multicast1, 0xff000000, 0xffffff00, 0x3, 0x3, {@mac=@broadcast, {[0x1fe, 0xff, 0xff, 0x0, 0xff, 0xff]}}, {@empty, {[0x0, 0xff, 0xff, 0xff, 0x0, 0xff]}}, 0x6, 0x2, 0xd9e7, 0x1, 0x2, 0x1000, 'vxcan1\x00', 'macvlan0\x00', {}, {0xff}, 0x0, 0x8}, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x0, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@AUDIT={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x408) syz_usb_control_io$hid(r1, 0x0, 0x0) socket(0x10, 0x803, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r5 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r5, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r4, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 1: timer_create(0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e0c"], 0xf) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) executing program 1: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) creat(&(0x7f0000000140)='./file0\x00', 0xf1) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = socket$kcm(0xa, 0x1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r5, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000000)=@ethtool_rxnfc={0x2a, 0x2, 0x6, {0xb, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @hdata="21ec713e6eeb076f1069460b0eda6bfa11b9c12001a61a09c12c0abba0298de9126a5918f5ab3bdaf8af26dee292ad9cdb394851", {0x0, @empty, 0x6, 0x5, [0x6, 0x9]}, 0xff, 0x2}}}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8916, &(0x7f0000000000)={r3}) r6 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x8916, &(0x7f0000000000)={r6}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8936, &(0x7f0000000000)={r6}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'nr0\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x1}}) r7 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000180)={0x3}) r8 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg$kcm(r8, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64=r7, @ANYRES64=r7, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) program did not crash replaying the whole log did not cause a kernel crash single: executing 4 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usbip_server_init-socket$inet6-setsockopt$inet6_int-connect$inet6-socket$nl_audit-socket$kcm-socket$kcm-socket$kcm-ioctl$sock_SIOCETHTOOL-ioctl$sock_kcm_SIOCKCMCLONE-socket$kcm-ioctl$sock_kcm_SIOCKCMCLONE-ioctl$sock_kcm_SIOCKCMCLONE-ioctl$sock_SIOCETHTOOL-openat$vimc1-ioctl$VIDIOC_SUBSCRIBE_EVENT-socket$kcm-recvmsg$kcm-write$usbip_server detailed listing: executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = socket$kcm(0xa, 0x1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r5, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000000)=@ethtool_rxnfc={0x2a, 0x2, 0x6, {0xb, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @hdata="21ec713e6eeb076f1069460b0eda6bfa11b9c12001a61a09c12c0abba0298de9126a5918f5ab3bdaf8af26dee292ad9cdb394851", {0x0, @empty, 0x6, 0x5, [0x6, 0x9]}, 0xff, 0x2}}}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8916, &(0x7f0000000000)={r3}) r6 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x8916, &(0x7f0000000000)={r6}) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8936, &(0x7f0000000000)={r6}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'nr0\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x1}}) r7 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000180)={0x3}) r8 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg$kcm(r8, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64=r7, @ANYRES64=r7, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) program crashed: BUG: corrupted list in em28xx_close_extension single: successfully extracted reproducer found reproducer with 28 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$hid-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$hid detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$hid(r2, 0x0, 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) program crashed: KASAN: slab-use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) program crashed: KASAN: use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) program crashed: KASAN: slab-use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r9, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r9, 0x89e0, &(0x7f0000000480)) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r9, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socket$phonet_pipe(0x23, 0x5, 0x2) program crashed: KASAN: slab-out-of-bounds Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) socket$kcm(0x2, 0x3, 0x2) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) socket$isdn_base(0x22, 0x3, 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) program crashed: KASAN: use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6 detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_generic(0x10, 0x3, 0x10) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) program crashed: KASAN: use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: KASAN: use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-syz_usb_connect detailed listing: executing program 0: memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: KASAN: slab-out-of-bounds Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-syz_usb_connect detailed listing: executing program 0: memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) socket(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-syz_usb_connect detailed listing: executing program 0: memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-out-of-bounds Read in em28xx_close_extension simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_close_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension validation run: crashed=true reproducing took 1h55m8.729526148s repro crashed as (corrupted=false): em28xx 1-1:246.0: AC97 chip type couldn't be determined em28xx 1-1:246.0: No AC97 audio processor non-slab/vmalloc memory list_add corruption. prev->next should be next (ffffffff8fc129e0), but was ffffffff818fba7d. (prev=ffff888031d18250). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:34! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 809 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004ab6b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 8c8e102affcd2a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff1d3d3d4 R12: 1ffff110063a304a R13: dffffc0000000000 R14: ffff888031d18250 R15: ffff888033868250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31e63fff CR3: 0000000032744000 CR4: 00000000003526f0 Call Trace: __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add_tail include/linux/list.h:191 [inline] em28xx_init_extension+0x56/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1114 em28xx_init_dev+0xc01/0x3280 drivers/media/usb/em28xx/em28xx-cards.c:3686 em28xx_usb_probe+0x157b/0x2b10 drivers/media/usb/em28xx/em28xx-cards.c:4041 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953 process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xbee/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004ab6b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 8c8e102affcd2a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff1d3d3d4 R12: 1ffff110063a304a R13: dffffc0000000000 R14: ffff888031d18250 R15: ffff888033868250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31e63fff CR3: 000000007d924000 CR4: 00000000003526f0 final repro crashed as (corrupted=false): em28xx 1-1:246.0: AC97 chip type couldn't be determined em28xx 1-1:246.0: No AC97 audio processor non-slab/vmalloc memory list_add corruption. prev->next should be next (ffffffff8fc129e0), but was ffffffff818fba7d. (prev=ffff888031d18250). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:34! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 809 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004ab6b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 8c8e102affcd2a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff1d3d3d4 R12: 1ffff110063a304a R13: dffffc0000000000 R14: ffff888031d18250 R15: ffff888033868250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31e63fff CR3: 0000000032744000 CR4: 00000000003526f0 Call Trace: __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add_tail include/linux/list.h:191 [inline] em28xx_init_extension+0x56/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1114 em28xx_init_dev+0xc01/0x3280 drivers/media/usb/em28xx/em28xx-cards.c:3686 em28xx_usb_probe+0x157b/0x2b10 drivers/media/usb/em28xx/em28xx-cards.c:4041 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953 process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xbee/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004ab6b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 8c8e102affcd2a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff1d3d3d4 R12: 1ffff110063a304a R13: dffffc0000000000 R14: ffff888031d18250 R15: ffff888033868250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31e63fff CR3: 000000007d924000 CR4: 00000000003526f0