Extracting prog: 2h24m28.723914976s
Minimizing prog: 6m35.628366064s
Simplifying prog options: 0s
Extracting C: 45.703292463s
Simplifying C: 10m40.703046554s


extracting reproducer from 67 programs
testing a last program of every proc
single: executing 17 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
close(r1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1-nanosleep-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-ftruncate-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-openat-write-openat-write-openat-write-mkdirat-openat-write-openat-write-openat-write-openat-write-openat-write-symlinkat-openat$nvme_fabrics-write-nanosleep-openat-pwrite64
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r9, &(0x7f0000000740)='0\n', 0x2)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r10 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r10, &(0x7f0000000840)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-ioctl$sock_inet_SIOCSIFFLAGS-ioctl$sock_inet_SIOCSIFFLAGS-mkdirat-mount-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-sendmsg$RDMA_NLDEV_CMD_NEWLINK-sendmsg$RDMA_NLDEV_CMD_NEWLINK-nanosleep-openat-read-openat-read-openat-read-openat-read
detailed listing:
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-ioctl$sock_inet_SIOCSIFFLAGS-ioctl$sock_inet_SIOCSIFFLAGS-mkdirat-mount-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-sendmsg$RDMA_NLDEV_CMD_NEWLINK-sendmsg$RDMA_NLDEV_CMD_NEWLINK-nanosleep-openat-read-openat-read-openat-read-openat-read
detailed listing:
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rfkill-write$rfkill-close-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rfkill-write$rfkill-close-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/hibernate/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='freezer\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='disk\n', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$uhid-write$UHID_CREATE2-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/driver\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='devices\n', 0x8)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/rtc/rtc0/wakealarm\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='+1\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='freeze\n', 0x7)
close(r3)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-mkdirat-mount-openat-write-write-openat-write-close-close-umount2-unshare-nanosleep
detailed listing:
executing program 0:
unshare(0x40000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.rpcsec.init/flush\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0\n', 0x2)
close(r0)
close(r1)
umount2(&(0x7f0000000140)='./proc\x00', 0x2)
unshare(0x40000000)
nanosleep(&(0x7f0000000400)={0x0, 0x5000000}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='devices\n', 0x8)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/rtc/rtc0/wakealarm\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='+1\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='freeze\n', 0x7)
close(r3)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$uhid-write$UHID_CREATE2-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/driver\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/hibernate/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='freezer\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='disk\n', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-mkdirat-mount-openat-write-write-openat-write-close-close-umount2-unshare-nanosleep
detailed listing:
executing program 0:
unshare(0x40000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.rpcsec.init/flush\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0\n', 0x2)
close(r0)
close(r1)
umount2(&(0x7f0000000140)='./proc\x00', 0x2)
unshare(0x40000000)
nanosleep(&(0x7f0000000400)={0x0, 0x5000000}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 67 programs with base timeout 6m0s
testing program (duration=6m16s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 22, 11, 7, 5, 2, 8, 4, 13, 2, 3, 5, 4, 15, 39, 15, 2, 5, 10, 4, 4, 3, 6, 8, 5, 6, 3, 4, 11, 14, 13, 14, 5, 10, 11, 3, 16, 20, 14, 6, 14, 4, 16, 32, 7, 5, 14, 19, 19, 12, 10, 4, 21, 2, 2, 13, 20, 8, 13, 4, 3, 11, 5, 3, 33, 8, 8]
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='-2 -3\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='1\n', 0x2)
close(r2)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040697a01000000010200010902200001010080320904000002ff0000000705010200020007058102000200"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x88, &(0x7f0000000140)={0x0, 0x0, 0x2}})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
executing program 0:
r0 = socket$inet(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x108, @loopback}, 0x10)
listen(r0, 0x40)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\n', 0x2)
executing program 2:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000800)
r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0)
write(r1, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uuid:12345678-1234-1234-1234-123456789abc,host_traddr=172.20.20.23,traddr=172.20.20.23,trsvcid=4420\x00', 0x95)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
setns(0xc9, 0x40000000)
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000100)={'dummy0\x00', {0x2, 0x0, @private=0xa010101}})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'dummy0\x00', 0x41})
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
r2 = socket$rds(0x15, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000300), 0x4)
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f304550700000000000109022200010100403209040100010300000009211101000122340007058103400001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00223400000005010902a1010901a100050919012903150025019503750181029501750581010501093009311581257f750895028106c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 0:
unshare(0x40000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.rpcsec.init/flush\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0\n', 0x2)
close(r0)
close(r1)
umount2(&(0x7f0000000140)='./proc\x00', 0x2)
unshare(0x40000000)
nanosleep(&(0x7f0000000400)={0x0, 0x5000000}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x2, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100)='\x00')
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/address_bits', 0x1, 0x0)
executing program 3:
r0 = socket$inet(0x2, 0x2, 0x0)
r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040250580100001000000010902200001010080320904000002ff00000007058102000200070502020002"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'\x00', 0x1})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/cpu/amd_pstate/status\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu0/cpufreq/scaling_driver\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
close(r0)
umount2(&(0x7f0000000000)='./config\x00', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/nullb0/power\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/io.max\x00', 0x1, 0x0)
write(r1, &(0x7f0000000440)='254:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r1, &(0x7f0000000480)='253:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r1, &(0x7f00000004c0)='252:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r1, &(0x7f0000000500)='251:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r1, &(0x7f0000000540)='250:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r1, &(0x7f0000000580)='249:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r1, &(0x7f00000005c0)='248:0 wbps=1048576 wiops=1\n\x00', 0x1b)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cg2\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./cg2\x00', &(0x7f0000000280)='cgroup2\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cg2/cgroup.subtree_control\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='+io\n\x00', 0x4)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./cg2/test\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cg2/test/cgroup.procs\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='0\n\x00', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./cg2/test/io.max\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='254:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r4, &(0x7f0000000480)='253:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r4, &(0x7f00000004c0)='252:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r4, &(0x7f0000000500)='251:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r4, &(0x7f0000000540)='250:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r4, &(0x7f0000000580)='249:0 wbps=1048576 wiops=1\n\x00', 0x1b)
write(r4, &(0x7f00000005c0)='248:0 wbps=1048576 wiops=1\n\x00', 0x1b)
close(r4)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000600), 0x4002, 0x0)
io_setup(0x1, &(0x7f0000000640)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000680)=[&(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000001000)='\x00'/4096, 0x1000, 0x0, 0x0, 0x0, 0x0}])
r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/nullb/nullb0/power\x00', 0x1, 0x0)
write(r7, &(0x7f0000000940)='0\n\x00', 0x2)
close(r7)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 *\n', 0x1c)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='* /tmp 2147483647 0 0 0 0\n', 0x1a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs(&(0x7f0000000340)='127.0.0.1:/tmp\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0))
faccessat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x4)
executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r0, &(0x7f0000000600)="112233440000000000000002000186a300000004000000000000000600000018000000010000000000000001000000010000000401020304000000060000001c040400ffffffffff00"/92, 0x5c, 0x0, &(0x7f0000000500)={0x2, 0x801, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:02.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:00.0\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/hibernate/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='freezer\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='disk\n', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/v4_end_grace\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='1\n', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/vmwgfx\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000600), 0x1000)
syz_open_dev$dri(&(0x7f0000000400), 0x1, 0x2)
openat$drirender128(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write$bt_hci(r0, &(0x7f0000000010)=ANY=[@ANYBLOB="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01"], 0x17)
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r1 = socket(0x1f, 0x5, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@generic={0x1f, "0000000000000100"}, 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/driver\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 *\n', 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r1, &(0x7f0000000300)=""/100, 0x64)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200), 0x1000)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='devices\n', 0x8)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/rtc/rtc0/wakealarm\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='+1\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='freeze\n', 0x7)
close(r3)
executing program 32:
unshare(0x40000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.rpcsec.init/flush\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0\n', 0x2)
close(r0)
close(r1)
umount2(&(0x7f0000000140)='./proc\x00', 0x2)
unshare(0x40000000)
nanosleep(&(0x7f0000000400)={0x0, 0x5000000}, 0x0)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='devices\n', 0x8)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/rtc/rtc0/wakealarm\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='+1\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='freeze\n', 0x7)
close(r3)
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/driver\x00', 0x0, 0x0)
executing program 35:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/hibernate/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='freezer\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='disk\n', 0x5)
executing program 36:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/lo/statistics/rx_dropped\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200), 0x1000)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='cell0:127.0.0.1\x00', 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000060)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f00000000a0)='add cell0 127.0.0.1\x00', 0x14)
r2 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r2, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(0x0, 0x0, &(0x7f0000000c00), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn'])
setxattr(&(0x7f0000000b00)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000400)='test\x00', 0x5, 0x0)
setxattr(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000400)='test\x00', 0x5, 0x0)
getxattr(&(0x7f0000000b00)='./file0/cell0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
getxattr(&(0x7f0000000e00)='./file1\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
executing program 6:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 6:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d041cc2000100000001090224000101008032090400000103000000092100000001222b000905810340000a0000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00222b0000000600ff0900a10185010901150026ff007508950781028505090575089504b1028507090775089504b102c0"], 0x0}, &(0x7f0000000300)={0x2c, &(0x7f0000000400)=ANY=[@ANYBLOB="00004000000005050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505"], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
nanosleep(&(0x7f0000000700)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000540)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/leds/g13:red:macro_preset_1/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000600)='1\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/leds/g13:red:macro_record/brightness\x00', 0x2, 0x0)
write(r2, &(0x7f0000000600), 0x2)
executing program 6:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./disk\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000100)='00', 0x1)
r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='./mnt\x00', &(0x7f0000000500)='qnx6\x00', 0x0, &(0x7f0000000600)='mmi_fs\x00')
executing program 6:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='cell0:127.0.0.1\x00', 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000060)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f00000000a0)='add cell0 127.0.0.1\x00', 0x14)
r2 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r2, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(0x0, 0x0, &(0x7f0000000c00), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn'])
setxattr(&(0x7f0000000b00)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000400)='test\x00', 0x5, 0x0)
setxattr(&(0x7f0000000b00)='./file0/cell0\x00', 0x0, &(0x7f0000000400)='test\x00', 0x5, 0x0)
getxattr(&(0x7f0000000b00)='./file0/cell0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
getxattr(&(0x7f0000000e00)='./file1\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
write(0xffffffffffffffff, &(0x7f0000000600)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000900)='freeze\n', 0x7)
close(r0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 *\n', 0x1c)
read(0xffffffffffffffff, &(0x7f0000000300)=""/100, 0x64)
executing program 37:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)
executing program 5:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 38:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='-2 -3\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n', 0x2)
nanosleep(&(0x7f0000000800)={0x2}, 0x0)
close(r2)
executing program 9:
ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
write$input_event(0xffffffffffffffff, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002e0), 0x18)
executing program 7:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000200)=""/32, 0x20, &(0x7f0000000300)=""/32, 0x20, &(0x7f0000000400)=""/32})
r1 = syz_open_dev$dri(&(0x7f0000000500), 0x0, 0x2)
ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000700)=""/32, 0x20, &(0x7f0000000800)=""/32, 0x20, &(0x7f0000000900)=""/32})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000300), &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000900)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r3, &(0x7f0000000b00)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d00)='localhost / 2147483647 16384 65534 65534 0\n', 0x2c)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000f00)='127.0.0.1:/\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1'])
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='-2 -3 +4.1\n', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/s1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/s1/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp\n', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='ipv4\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='127.0.0.1\n', 0xa)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='4420\n', 0x5)
close(r4)
symlinkat(&(0x7f0000000480)='./config/nvmet/subsystems/s1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/subsystems/s1\x00')
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0000:00:01.0\x00', 0xc)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='i915\x00', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0000:00:01.0\x00', 0xc)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 20000\n', 0xa)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
nanosleep(&(0x7f0000000780)={0x0, 0xbebc200}, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000800)={0x2, 0x4e20, @loopback}, 0x10)
write(r2, &(0x7f0000000900)="80000054000000010000000000000002000186a30000000400000001000000000000000000000000000000000000000000000002000000010000004400000000000000000000000000000000000000000000000000001000", 0x58)
read(r2, &(0x7f0000000a00)=""/1024, 0x400)
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, 0x9, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x38}}, 0x0)
sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, 0x7, 0x6, 0x301, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}}, 0x0)
executing program 8:
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r0, &(0x7f0000000300)=""/100, 0x64)
executing program 8:
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(r0, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002e0), 0x18)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00snapshot\x00\x00\x00\x00\x00\x00\x00\x007:0 7:1 N 8\x00\x00\x00\x00\x00', 0x38)
ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000007001000038010000010000000000000000000000000000000000000000000000000000006d79706f6f6c00")
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='si4713 0x63\n', 0xc)
executing program 8:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r9, &(0x7f0000000740)='0\n', 0x2)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r10 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r10, &(0x7f0000000840)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
close(r1)

program crashed: no output from test machine
bisect: bisecting 67 programs
bisect: split chunks (needed=false): <67>
bisect: split chunk #0 of len 67 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m11s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5, 6, 3, 4, 11, 14, 13, 14, 5, 10, 11, 3, 16, 20, 14, 6, 14, 4, 16, 32, 7, 5, 14, 19, 19, 12, 10, 4, 21, 2, 2, 13, 20, 8, 13, 4, 3, 11, 5, 3, 33, 8, 8]
detailed listing:
executing program 1:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6)
write$bt_hci(r0, &(0x7f0000000010)=ANY=[@ANYBLOB="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01"], 0x17)
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r1 = socket(0x1f, 0x5, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@generic={0x1f, "0000000000000100"}, 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/driver\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 *\n', 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r1, &(0x7f0000000300)=""/100, 0x64)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200), 0x1000)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='devices\n', 0x8)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/rtc/rtc0/wakealarm\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='+1\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='freeze\n', 0x7)
close(r3)
executing program 32:
unshare(0x40000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
write(r0, &(0x7f0000000100)='foo bar 0 0 0 baz qux\n', 0x16)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.rpcsec.init/flush\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0\n', 0x2)
close(r0)
close(r1)
umount2(&(0x7f0000000140)='./proc\x00', 0x2)
unshare(0x40000000)
nanosleep(&(0x7f0000000400)={0x0, 0x5000000}, 0x0)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='devices\n', 0x8)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/rtc/rtc0/wakealarm\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='+1\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='freeze\n', 0x7)
close(r3)
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/driver\x00', 0x0, 0x0)
executing program 35:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/hibernate/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='freezer\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='disk\n', 0x5)
executing program 36:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/lo/statistics/rx_dropped\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200), 0x1000)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='cell0:127.0.0.1\x00', 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000060)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f00000000a0)='add cell0 127.0.0.1\x00', 0x14)
r2 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r2, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(0x0, 0x0, &(0x7f0000000c00), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn'])
setxattr(&(0x7f0000000b00)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000400)='test\x00', 0x5, 0x0)
setxattr(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000400)='test\x00', 0x5, 0x0)
getxattr(&(0x7f0000000b00)='./file0/cell0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
getxattr(&(0x7f0000000e00)='./file1\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
executing program 6:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x0, 0x0, 0x4, "80000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 6:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d041cc2000100000001090224000101008032090400000103000000092100000001222b000905810340000a0000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00222b0000000600ff0900a10185010901150026ff007508950781028505090575089504b1028507090775089504b102c0"], 0x0}, &(0x7f0000000300)={0x2c, &(0x7f0000000400)=ANY=[@ANYBLOB="00004000000005050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505"], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
syz_usb_control_io$hid(r0, &(0x7f0000000100), &(0x7f0000000300))
nanosleep(&(0x7f0000000700)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000540)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/leds/g13:red:macro_preset_1/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000600)='1\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/leds/g13:red:macro_record/brightness\x00', 0x2, 0x0)
write(r2, &(0x7f0000000600), 0x2)
executing program 6:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./disk\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000100)='00', 0x1)
r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='./mnt\x00', &(0x7f0000000500)='qnx6\x00', 0x0, &(0x7f0000000600)='mmi_fs\x00')
executing program 6:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='cell0:127.0.0.1\x00', 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000060)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f00000000a0)='add cell0 127.0.0.1\x00', 0x14)
r2 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r2, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(0x0, 0x0, &(0x7f0000000c00), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn'])
setxattr(&(0x7f0000000b00)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000400)='test\x00', 0x5, 0x0)
setxattr(&(0x7f0000000b00)='./file0/cell0\x00', 0x0, &(0x7f0000000400)='test\x00', 0x5, 0x0)
getxattr(&(0x7f0000000b00)='./file0/cell0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
getxattr(&(0x7f0000000e00)='./file1\x00', &(0x7f0000000300)=ANY=[@ANYBLOB='afs.acl\x00'], &(0x7f0000000500), 0x100)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
write(0xffffffffffffffff, &(0x7f0000000600)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000900)='freeze\n', 0x7)
close(r0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 *\n', 0x1c)
read(0xffffffffffffffff, &(0x7f0000000300)=""/100, 0x64)
executing program 37:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)
executing program 5:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 38:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='-2 -3\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n', 0x2)
nanosleep(&(0x7f0000000800)={0x2}, 0x0)
close(r2)
executing program 9:
ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
write$input_event(0xffffffffffffffff, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002e0), 0x18)
executing program 7:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000200)=""/32, 0x20, &(0x7f0000000300)=""/32, 0x20, &(0x7f0000000400)=""/32})
r1 = syz_open_dev$dri(&(0x7f0000000500), 0x0, 0x2)
ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000700)=""/32, 0x20, &(0x7f0000000800)=""/32, 0x20, &(0x7f0000000900)=""/32})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000300), &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000900)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r3, &(0x7f0000000b00)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d00)='localhost / 2147483647 16384 65534 65534 0\n', 0x2c)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000f00)='127.0.0.1:/\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1'])
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='-2 -3 +4.1\n', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/s1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/s1/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp\n', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='ipv4\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='127.0.0.1\n', 0xa)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='4420\n', 0x5)
close(r4)
symlinkat(&(0x7f0000000480)='./config/nvmet/subsystems/s1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/subsystems/s1\x00')
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0000:00:01.0\x00', 0xc)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='i915\x00', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0000:00:01.0\x00', 0xc)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 20000\n', 0xa)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
nanosleep(&(0x7f0000000780)={0x0, 0xbebc200}, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000800)={0x2, 0x4e20, @loopback}, 0x10)
write(r2, &(0x7f0000000900)="80000054000000010000000000000002000186a30000000400000001000000000000000000000000000000000000000000000002000000010000004400000000000000000000000000000000000000000000000000001000", 0x58)
read(r2, &(0x7f0000000a00)=""/1024, 0x400)
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, 0x9, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x38}}, 0x0)
sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, 0x7, 0x6, 0x301, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}}, 0x0)
executing program 8:
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r0, &(0x7f0000000300)=""/100, 0x64)
executing program 8:
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(r0, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002e0), 0x18)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00snapshot\x00\x00\x00\x00\x00\x00\x00\x007:0 7:1 N 8\x00\x00\x00\x00\x00', 0x38)
ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000007001000038010000010000000000000000000000000000000000000000000000000000006d79706f6f6c00")
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='si4713 0x63\n', 0xc)
executing program 8:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r9, &(0x7f0000000740)='0\n', 0x2)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r10 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r10, &(0x7f0000000840)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
close(r1)

program crashed: WARNING in usb_free_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 19, 19, 12, 10, 4, 21, 2, 2, 13, 20, 8, 13, 4, 3, 11, 5, 3, 33, 8, 8]
detailed listing:
executing program 37:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)
executing program 5:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 38:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='-2 -3\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n', 0x2)
nanosleep(&(0x7f0000000800)={0x2}, 0x0)
close(r2)
executing program 9:
ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
write$input_event(0xffffffffffffffff, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002e0), 0x18)
executing program 7:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000200)=""/32, 0x20, &(0x7f0000000300)=""/32, 0x20, &(0x7f0000000400)=""/32})
r1 = syz_open_dev$dri(&(0x7f0000000500), 0x0, 0x2)
ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000700)=""/32, 0x20, &(0x7f0000000800)=""/32, 0x20, &(0x7f0000000900)=""/32})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000300), &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000900)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r3, &(0x7f0000000b00)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d00)='localhost / 2147483647 16384 65534 65534 0\n', 0x2c)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000f00)='127.0.0.1:/\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1'])
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='-2 -3 +4.1\n', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/s1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/s1/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp\n', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='ipv4\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='127.0.0.1\n', 0xa)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='4420\n', 0x5)
close(r4)
symlinkat(&(0x7f0000000480)='./config/nvmet/subsystems/s1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/subsystems/s1\x00')
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0000:00:01.0\x00', 0xc)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='i915\x00', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0000:00:01.0\x00', 0xc)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 20000\n', 0xa)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
nanosleep(&(0x7f0000000780)={0x0, 0xbebc200}, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000800)={0x2, 0x4e20, @loopback}, 0x10)
write(r2, &(0x7f0000000900)="80000054000000010000000000000002000186a30000000400000001000000000000000000000000000000000000000000000002000000010000004400000000000000000000000000000000000000000000000000001000", 0x58)
read(r2, &(0x7f0000000a00)=""/1024, 0x400)
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, 0x9, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x38}}, 0x0)
sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, 0x7, 0x6, 0x301, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}}, 0x0)
executing program 8:
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r0, &(0x7f0000000300)=""/100, 0x64)
executing program 8:
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(r0, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002e0), 0x18)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00snapshot\x00\x00\x00\x00\x00\x00\x00\x007:0 7:1 N 8\x00\x00\x00\x00\x00', 0x38)
ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000007001000038010000010000000000000000000000000000000000000000000000000000006d79706f6f6c00")
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='si4713 0x63\n', 0xc)
executing program 8:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r9, &(0x7f0000000740)='0\n', 0x2)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r10 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r10, &(0x7f0000000840)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
close(r1)

program crashed: KASAN: invalid-free in usb_free_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
bisect: split chunks (needed=true): <21>
bisect: split chunk #0 of len 21 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 4, 3, 11, 5, 3, 33, 8, 8]
detailed listing:
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0000:00:01.0\x00', 0xc)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='i915\x00', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0000:00:01.0\x00', 0xc)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 20000\n', 0xa)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
nanosleep(&(0x7f0000000780)={0x0, 0xbebc200}, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000800)={0x2, 0x4e20, @loopback}, 0x10)
write(r2, &(0x7f0000000900)="80000054000000010000000000000002000186a30000000400000001000000000000000000000000000000000000000000000002000000010000004400000000000000000000000000000000000000000000000000001000", 0x58)
read(r2, &(0x7f0000000a00)=""/1024, 0x400)
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, 0x9, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x38}}, 0x0)
sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, 0x7, 0x6, 0x301, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}}, 0x0)
executing program 8:
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r0, &(0x7f0000000300)=""/100, 0x64)
executing program 8:
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(r0, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(r0, &(0x7f00000002e0), 0x18)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00snapshot\x00\x00\x00\x00\x00\x00\x00\x007:0 7:1 N 8\x00\x00\x00\x00\x00', 0x38)
ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000007001000038010000010000000000000000000000000000000000000000000000000000006d79706f6f6c00")
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='si4713 0x63\n', 0xc)
executing program 8:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r9, &(0x7f0000000740)='0\n', 0x2)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r10 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r10, &(0x7f0000000840)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
executing program 7:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
close(r1)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 19, 19, 12, 10, 4, 21, 2, 2, 13, 20]
detailed listing:
executing program 37:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$rfkill(r0, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x1}, 0x8)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='devices\n', 0x8)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000340)='freeze\n', 0x7)
close(r3)
executing program 5:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 38:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'dummy0\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00', 0x41})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'\x00', 0x41})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/infiniband/syz0/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r2, &(0x7f0000000600)=""/64, 0x40)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/infiniband/syz1/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r3, &(0x7f0000000800)=""/64, 0x40)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/infiniband/syz2/ports/1/hw_counters/lifespan\x00', 0x0, 0x0)
read(r4, &(0x7f0000000a00)=""/64, 0x40)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/infiniband/syz0/hw_counters/lifespan\x00', 0x0, 0x0)
read(r5, &(0x7f0000000c00)=""/64, 0x40)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='-2 -3\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n', 0x2)
nanosleep(&(0x7f0000000800)={0x2}, 0x0)
close(r2)
executing program 9:
ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x1d)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x38)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x6f)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
write$input_event(0xffffffffffffffff, &(0x7f0000000240)={{}, 0x1, 0x1d, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f0000000280)={{}, 0x1, 0x38, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002c0)={{}, 0x1, 0x6f, 0x1}, 0x18)
write$input_event(0xffffffffffffffff, &(0x7f00000002e0), 0x18)
executing program 7:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000200)=""/32, 0x20, &(0x7f0000000300)=""/32, 0x20, &(0x7f0000000400)=""/32})
r1 = syz_open_dev$dri(&(0x7f0000000500), 0x0, 0x2)
ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x20, &(0x7f0000000700)=""/32, 0x20, &(0x7f0000000800)=""/32, 0x20, &(0x7f0000000900)=""/32})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000300), &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000900)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r3, &(0x7f0000000b00)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d00)='localhost / 2147483647 16384 65534 65534 0\n', 0x2c)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000f00)='127.0.0.1:/\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1'])
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='-2 -3 +4.1\n', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/s1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/s1/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp\n', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='ipv4\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='127.0.0.1\n', 0xa)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='4420\n', 0x5)
close(r4)
symlinkat(&(0x7f0000000480)='./config/nvmet/subsystems/s1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/subsystems/s1\x00')

program crashed: WARNING in enable_work
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <11>
bisect: split chunk #0 of len 11 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 2, 2, 13, 20]
detailed listing:
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000300), &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000900)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r3, &(0x7f0000000b00)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d00)='localhost / 2147483647 16384 65534 65534 0\n', 0x2c)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000f00)='127.0.0.1:/\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1'])
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='-2 -3 +4.1\n', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/s1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/s1/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp\n', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='ipv4\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='127.0.0.1\n', 0xa)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='4420\n', 0x5)
close(r4)
symlinkat(&(0x7f0000000480)='./config/nvmet/subsystems/s1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/subsystems/s1\x00')

program crashed: WARNING in usb_free_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 20]
detailed listing:
executing program 9:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='-2 -3 +4.1\n', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/s1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/s1/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp\n', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='ipv4\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='127.0.0.1\n', 0xa)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='4420\n', 0x5)
close(r4)
symlinkat(&(0x7f0000000480)='./config/nvmet/subsystems/s1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/subsystems/s1\x00')

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 2, 2]
detailed listing:
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000300), &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000900)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r3, &(0x7f0000000b00)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d00)='localhost / 2147483647 16384 65534 65534 0\n', 0x2c)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000f00)='127.0.0.1:/\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1'])
executing program 9:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)

program crashed: WARNING in enable_work
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)

program crashed: WARNING in usb_free_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)

program crashed: WARNING in usb_free_urb
bisect: concatenation succeeded
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=1m52.923218756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)

program crashed: WARNING in usb_free_urb
testing program (duration=1m52.923218756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, 0x0, 0x0)

program did not crash
testing program (duration=1m52.923218756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m52.923218756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
simplifying C reproducer
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing compiled C program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in usb_free_urb
testing program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)

program crashed: WARNING in usb_free_urb
validation run: crashed=true
testing program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)

program crashed: WARNING in usb_free_urb
validation run: crashed=true
testing program (duration=1m52.923218756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)

program crashed: WARNING in smsusb_term_device
validation run: crashed=true
reproducing took 2h47m34.090225326s
repro crashed as (corrupted=false):
smsusb:smsusb_init_device: smscore_start_device(...) failed
------------[ cut here ]------------
data & WORK_STRUCT_PWQ
WARNING: kernel/workqueue.c:4425 at __flush_work+0xc8f/0xd70 kernel/workqueue.c:4425, CPU#1: kworker/1:4/5659
Modules linked in:
CPU: 1 UID: 0 PID: 5659 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:__flush_work+0xc8f/0xd70 kernel/workqueue.c:4425
Code: 38 00 90 0f 0b 90 31 c0 49 bd f8 f8 f8 f8 f8 f8 f8 f8 e9 2d ff ff ff e8 7f 24 38 00 4d 89 f4 e9 ee fa ff ff e8 72 24 38 00 90 <0f> 0b 90 e9 23 fd ff ff e8 a4 60 ca 09 e8 5f 24 38 00 48 c7 c7 80
RSP: 0018:ffffc900051ce960 EFLAGS: 00010293
RAX: ffffffff818eb3be RBX: ffff88813fe4a005 RCX: ffff88803a410000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900051ceb18 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f64590 R12: dffffc0000000000
R13: f8f8f8f8f8f8f8f8 R14: 1ffff92000a39d34 R15: ffffc900051cea08
FS:  0000000000000000(0000) GS:ffff888125cc2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e9993643c CR3: 0000000045a10000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __cancel_work_sync+0xbf/0x110 kernel/workqueue.c:4568
 smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:183 [inline]
 smsusb_term_device+0xdd/0x3d0 drivers/media/usb/siano/smsusb.c:345
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1aba/0x2280 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2713
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
smsusb:smsusb_init_device: smscore_start_device(...) failed
------------[ cut here ]------------
data & WORK_STRUCT_PWQ
WARNING: kernel/workqueue.c:4425 at __flush_work+0xc8f/0xd70 kernel/workqueue.c:4425, CPU#1: kworker/1:4/5659
Modules linked in:
CPU: 1 UID: 0 PID: 5659 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:__flush_work+0xc8f/0xd70 kernel/workqueue.c:4425
Code: 38 00 90 0f 0b 90 31 c0 49 bd f8 f8 f8 f8 f8 f8 f8 f8 e9 2d ff ff ff e8 7f 24 38 00 4d 89 f4 e9 ee fa ff ff e8 72 24 38 00 90 <0f> 0b 90 e9 23 fd ff ff e8 a4 60 ca 09 e8 5f 24 38 00 48 c7 c7 80
RSP: 0018:ffffc900051ce960 EFLAGS: 00010293
RAX: ffffffff818eb3be RBX: ffff88813fe4a005 RCX: ffff88803a410000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900051ceb18 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f64590 R12: dffffc0000000000
R13: f8f8f8f8f8f8f8f8 R14: 1ffff92000a39d34 R15: ffffc900051cea08
FS:  0000000000000000(0000) GS:ffff888125cc2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e9993643c CR3: 0000000045a10000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __cancel_work_sync+0xbf/0x110 kernel/workqueue.c:4568
 smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:183 [inline]
 smsusb_term_device+0xdd/0x3d0 drivers/media/usb/siano/smsusb.c:345
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1aba/0x2280 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2713
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>