Extracting prog: 5h46m42.521684027s
Minimizing prog: 3h43m29.573691557s
Simplifying prog options: 0s
Extracting C: 2m48.114188834s
Simplifying C: 1h8m0.350464685s


extracting reproducer from 25 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-io_setup-io_submit-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-openat-dup-readv
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-nanosleep-write$UHID_INPUT2
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$char_usb-ioctl$EVIOCGMASK-sendmsg$NFC_CMD_DEV_UP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$char_usb-ioctl$EVIOCGMASK-sendmsg$NFC_CMD_DEV_UP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 10, 10, 5, 11, 7, 10, 4, 9, 10, 12, 7, 5, 10, 12, 9, 3, 10, 11]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
read$FUSE(r0, 0x0, 0x0)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(r1, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 3:
r0 = syz_create_resource$futex(&(0x7f0000000740)=0x1)
futex(r0, 0x9, 0x1, 0x0, r0, 0x2)
futex(r0, 0x3, 0x5, 0x0, r0, 0x10400001)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-io_setup-io_submit-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-openat-dup-readv
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-nanosleep-write$UHID_INPUT2
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$char_usb-ioctl$EVIOCGMASK-sendmsg$NFC_CMD_DEV_UP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$char_usb-ioctl$EVIOCGMASK-sendmsg$NFC_CMD_DEV_UP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 1m40s
testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 10, 10, 5, 11, 7, 10, 4, 9, 10, 12, 7, 5, 10, 12, 9, 3, 10, 11]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
read$FUSE(r0, 0x0, 0x0)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(r1, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 3:
r0 = syz_create_resource$futex(&(0x7f0000000740)=0x1)
futex(r0, 0x9, 0x1, 0x0, r0, 0x2)
futex(r0, 0x3, 0x5, 0x0, r0, 0x10400001)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-io_setup-io_submit-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-openat-dup-readv
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-nanosleep-write$UHID_INPUT2
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$char_usb-ioctl$EVIOCGMASK-sendmsg$NFC_CMD_DEV_UP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$char_usb-ioctl$EVIOCGMASK-sendmsg$NFC_CMD_DEV_UP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 6m0s
testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 10, 10, 5, 11, 7, 10, 4, 9, 10, 12, 7, 5, 10, 12, 9, 3, 10, 11]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
read$FUSE(r0, 0x0, 0x0)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(r1, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 3:
r0 = syz_create_resource$futex(&(0x7f0000000740)=0x1)
futex(r0, 0x9, 0x1, 0x0, r0, 0x2)
futex(r0, 0x3, 0x5, 0x0, r0, 0x10400001)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: bisecting 25 programs
bisect: split chunks (needed=false): <25>
bisect: split chunk #0 of len 25 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11, 7, 10, 4, 9, 10, 12, 7, 5, 10, 12, 9, 3, 10, 11]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
read$FUSE(r0, 0x0, 0x0)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(r1, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 3:
r0 = syz_create_resource$futex(&(0x7f0000000740)=0x1)
futex(r0, 0x9, 0x1, 0x0, r0, 0x2)
futex(r0, 0x3, 0x5, 0x0, r0, 0x10400001)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 10, 10, 5, 10, 12, 9, 3, 10, 11]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
read$FUSE(r0, 0x0, 0x0)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(r1, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 3:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 3:
r0 = syz_create_resource$futex(&(0x7f0000000740)=0x1)
futex(r0, 0x9, 0x1, 0x0, r0, 0x2)
futex(r0, 0x3, 0x5, 0x0, r0, 0x10400001)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 10, 10, 5, 11, 7, 10, 4, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <9>, <9>
bisect: split chunk #0 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 10, 10, 10, 5, 11, 7, 10, 4, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 5, 11, 7, 10, 4, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/netfilter/nf_hooks_lwtunnel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000007c00)={'syzkaller0\x00', 0x1})
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000007c40), 0x12)
listen(r2, 0x1)
write$tun(r0, &(0x7f0000007c80)=ANY=[@ANYBLOB="000008050000010b"], 0x88)
r3 = accept(r2, 0x0, 0x0)
write(r3, &(0x7f0000007d40)="e693c5dd438eef66242fd50909ae82e82e1d2b8c30283fe9cad07f1937717e3a8b04843b2dca8ee4b007ff771dc2031b177701c8fb2be78f853d3ca5fc9d805dc127441334128864cfa245753d97c86d5d84587456ad7633b463b64832030b79921459cd77bf24de452bd6603050d3193a018a3d18f81f2e3d97692ccadea26d6478", 0x82)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x5, 0x57e, 0x2017, 0x0, 0x0, "05010905a1018521150026ff00750895308102c0"}}, 0x12c)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='\f\x00\x00\x001\x00'], 0x37)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: split chunk #1 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 10, 10, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>, <4>, <4>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 7, 10, 10, 10, 9, 10, 12, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 7, 10, 10, 10, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 10, 10, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 2:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
pipe2$9p(&(0x7f0000000080), 0x4800)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='X', 0x1, 0x0, 0x0, 0x0)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 9, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x50048, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xeea, 0x4)
write$FUSE_ATTR(r1, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0x0, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, 0x0, 0x3001, 0x2}}}, 0xffffff03)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: split chunk #2 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 2, 11, 12, 7, 10, 12, 7]
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00')
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <3>, <2>, <2>, <2>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11, 12, 7, 10, 12, 7]
detailed listing:
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 12, 7, 10, 12, 7]
detailed listing:
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000005cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000005e40)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="200a0200000093f5"], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000005ec0)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000005f00)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000005f40)="0b00020002000000010001")
mkdirat(0xffffffffffffff9c, &(0x7f0000005f80)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005fc0)='./sys\x00', &(0x7f0000006000)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000006040)='./sys/bus/greybus/devices/1-svc/watchdog_action\x00', 0x2, 0x0)
r2 = dup(r1)
readv(r2, &(0x7f0000006240)=[{&(0x7f0000006280)=""/149, 0x95}], 0x1)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11, 7, 10, 12, 7]
detailed listing:
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: split chunk #2 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11, 10, 12, 7]
detailed listing:
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #3 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11, 10, 7]
detailed listing:
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000006280))
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000005ec0)={0x1, &(0x7f0000005f00)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11, 10, 12]
detailed listing:
executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>, <1>, <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #3 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 4 programs left: 

executing program 0:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)


bisect: trying to concatenate
bisect: concatenate 4 entries
minimizing program #0 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11, 10, 12]
detailed listing:
executing program 0:
openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0xa0201, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
minimized 2 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800))
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 10, 12]
detailed listing:
executing program 0:
executing program 0:
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x40040)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program did not crash
minimized 11 calls -> 5 calls
minimizing program #2 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 9, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 8, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 7, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x3, 0x1, 0x80}})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 6, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 5, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
syz_usb_connect(0x0, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 4, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+p', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 3, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 2, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 1, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 12]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
minimized 10 calls -> 0 calls
minimizing program #3 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 11]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 11]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000001000)='\x00'/512, 0x200}])
write(0xffffffffffffffff, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 11]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
io_setup(0x2, &(0x7f0000000800))
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 10]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
openat(0xffffffffffffff9c, &(0x7f0000000740)='./dev/nullb1\x00', 0x4002, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 9]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 8]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 8]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000520)='250:1 1', 0x7)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 8]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 8]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 7]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 6]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 0, 6]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
executing program 0:
executing program 0:
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
minimized 12 calls -> 7 calls
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mount-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
bisect: concatenation succeeded
found reproducer with 12 syscalls
minimizing guilty program
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mount-mkdirat-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mount-mkdirat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
write(0xffffffffffffffff, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mount-mkdirat-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mount-mkdirat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000520)='250:1 1', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280), 0x0)
io_submit(0x0, 0x1, &(0x7f0000000840)=[&(0x7f0000000880)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='\x00'/512, 0x200}])
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520), 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)

program did not crash
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
simplifying C reproducer
testing compiled C program (duration=8m6.993674712s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program did not crash
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing compiled C program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
program crashed: WARNING: lock held when returning to user space in blk_throtl_init
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
validation run: crashed=true
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
validation run: crashed=false
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
validation run: crashed=false
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
validation run: crashed=false
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program did not crash
validation run: crashed=false
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
validation run: crashed=true
testing program (duration=8m6.993674712s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-io_submit-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='1', 0x1)
io_submit(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000520)='250:1 1', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a40)='0', 0x1)

program crashed: WARNING: lock held when returning to user space in blk_throtl_init
validation run: crashed=true
reproducing took 11h24m47.140972808s
repro crashed as (corrupted=false):
null_blk: disk nullb1 created
================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
syz.0.452/6787 is leaving the kernel with locks still held!
locks held by syz.0.452/6787: 2, last CPU#0:
 #0: ffff88803652c190 (&q->q_usage_counter(io)#105){++++}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline]
 #0: ffff88803652c190 (&q->q_usage_counter(io)#105){++++}-{0:0}, at: blk_throtl_init+0x27b/0x420 block/blk-throttle.c:1332
 #1: ffff88803652c1c8 (&q->q_usage_counter(queue)#88){+.+.}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline]
 #1: ffff88803652c1c8 (&q->q_usage_counter(queue)#88){+.+.}-{0:0}, at: blk_throtl_init+0x27b/0x420 block/blk-throttle.c:1332

final repro crashed as (corrupted=false):
null_blk: disk nullb1 created
================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
syz.0.452/6787 is leaving the kernel with locks still held!
locks held by syz.0.452/6787: 2, last CPU#0:
 #0: ffff88803652c190 (&q->q_usage_counter(io)#105){++++}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline]
 #0: ffff88803652c190 (&q->q_usage_counter(io)#105){++++}-{0:0}, at: blk_throtl_init+0x27b/0x420 block/blk-throttle.c:1332
 #1: ffff88803652c1c8 (&q->q_usage_counter(queue)#88){+.+.}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline]
 #1: ffff88803652c1c8 (&q->q_usage_counter(queue)#88){+.+.}-{0:0}, at: blk_throtl_init+0x27b/0x420 block/blk-throttle.c:1332