Extracting prog: 1h4m38.75464905s
Minimizing prog: 28m45.071633382s
Simplifying prog options: 0s
Extracting C: 45.263841895s
Simplifying C: 12m47.199116725s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-mmap-syz_open_procfs-lseek-getdents64
detailed listing:
executing program 0:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 9, 9, 9, 9, 9, 9, 5, 5, 5, 5, 5, 5, 5, 5, 5, 17, 5, 5, 20, 5, 5, 5, 15, 5, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10)
listen(r0, 0x5)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10)
r2 = accept(r0, 0x0, 0x0)
setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000080)='espintcp\x00', 0x9)
sendto(r1, &(0x7f0000000100)='\x00\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xa, 0x0, 0x0, 0x0)
recvfrom(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x25000, 0x4, 0xe, 0xf1, 0x3, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0xf7, 0x4f}, {0xf000, 0x0, 0xd, 0x19, 0x8, 0x3, 0x6, 0xb, 0x7, 0xf, 0x3, 0xc0}, {0x8080000, 0x26000, 0xb, 0x2, 0x2, 0x5, 0x24, 0x9, 0x5, 0x96, 0xc4, 0x15}, {0x60000, 0x9000, 0x4, 0xf8, 0x3, 0x68, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x1, 0xa000, 0x9, 0x1, 0x3, 0x9, 0xd, 0x6, 0x5, 0x9, 0x2e, 0x4b}, {0x6000, 0xeeee0000, 0xa, 0x9, 0x3, 0x1, 0x1, 0xc6, 0x4, 0x90, 0x1, 0xfc}, {0xffffffff, 0x4000, 0xf, 0xff, 0x3, 0xfb, 0x0, 0xb, 0x1, 0x7, 0x43, 0xfc}, {0xf7f63004, 0x1, 0xf, 0x4, 0xfc, 0x3, 0xa, 0x1, 0x54, 0x1, 0xff, 0x5}, {0xeeef0000, 0x3}, {0x80a0000, 0x9}, 0x4005001d, 0x0, 0xffff1000, 0x40310, 0x5, 0x2100, 0xe6e70c00, [0x3, 0x20000401, 0x8, 0xc5]})
memfd_create(&(0x7f0000000000)='-&:{-\xaa]{\x00', 0x2)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0xb, 0xe, '\x00', 0xc2})
ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000000)={0x8000000, 0xffff1000, 0x1, 0x1, 0x999})
executing program 0:
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0)
r0 = creat(&(0x7f0000000540)='./file0\x00', 0x0)
close(r0)
landlock_create_ruleset(0x0, 0x0, 0x2)
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 0:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d3", 0xfb}], 0x1}, 0x84)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100003800c"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000200)={'syzkaller1\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x1}}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff00000007058102"], 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_ep_write(r1, 0x81, 0x1, &(0x7f0000000700)='\x00')
read$char_usb(r2, &(0x7f0000000600)=""/64, 0x40)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c36302725166")
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r3, 0x0, 0x18)
executing program 0:
sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000)
socket$packet(0x11, 0xa, 0x300)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x3c)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff2"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1)
executing program 32:
sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000)
socket$packet(0x11, 0xa, 0x300)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x3c)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff2"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./gadgetfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./gadgetfs\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadgetfs/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000400)="000000000902190001010080010904000001ffffff000705810240000012011001000000402505a0a4000000000001", 0x2f)
read(r0, &(0x7f0000000500), 0x10)
executing program 1:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
r0 = syz_usb_connect$uac2(0x5, 0xa0, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x15, 0x7}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100fdffffbf00010000e0000002000000080000000000000000ffffffff000000000000000000000000000329944e230020020000003c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="7f000001000000000000000000000000000004d36c00000000000000000000000000ffffac141418000000000000000009000000000000000600000000000000ffff0000000000001c25080000000000020000000000000083000000000000000000000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000002000000fcffffff000000002cbd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x20000810)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {}, 0x0, 0x0, 0x1}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x41}, 0x4d3, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x3, 0x0, 0x0, 0x400000}}, 0xe8)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0xfd, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x40, @multicast2}}, {{0x2, 0x400, @loopback}}}, 0x108)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000700)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108)
r1 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00')
preadv(r1, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/93, 0x5d}], 0x1, 0x0, 0x0)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x6)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
executing program 1:
r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, 0x0, 0x4008094)
write$FUSE_INTERRUPT(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x53, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0xa6, 0x80, 0xe1, 0x40, 0x1199, 0x6804, 0x9714, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0x3c, 0x0, 0x6, "", [{{0x9, 0x4, 0xef, 0xc6, 0x5, 0xbb, 0x57, 0x13, 0x3, [], [{{0x9, 0x5, 0xf, 0x10, 0x440, 0x4, 0x4, 0x9}}, {{0x9, 0x5, 0x5, 0x0, 0x10, 0x3, 0xe, 0x9, [@generic={0x2, 0x9}]}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x5, 0xf2, 0x4}}, {{0x9, 0x5, 0x4, 0x2, 0x200, 0x81, 0x6}}, {{0x9, 0x5, 0xc, 0x0, 0x20, 0x6, 0x5, 0xa}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='10', 0x2)
write$binfmt_misc(r0, 0x0, 0x0)
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x184, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa67", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c", @nested={0x51, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765"]}, @nested={0x55, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64", @typed={0x8, 0xff, 0x0, 0x0, @fd}]}]}, 0x184}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000180)=0xde)
executing program 4:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/12, 0xc)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x390, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa6753", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c0b8246c6b87fd89f3f956f888c49dc151b2c259d244855622d00eaf5297e8f6476b0add6f25110be6a3bd1f0e0a5cadf1a2276b0ccef4927b7a9e8184e52bf5b84e179feea7ba7d1c69006b02687c4ac99ea0b1ef301ace51ffe2d52b7296ed8d447fc90", @nested={0xa1, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765b37d127fb22369919cc2f1ce6f42fb1e70e750eb7d0f3e4e55c6db8241f4f9f6a9a2a06d5c87d3d4e2e7f160a5ff288bfae1bbdab738266ea5add0d9e0389b9c747c23ce874f6d558289d7073939016e"]}, @generic="af600e2d6428734e419378d87ba8997f836a8a15501437a011c5e77f10b2a15491db405e0b4d83d0051c7665556b27760995551a35fd43c81c8a63", @nested={0xe1, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64c36be58fef628e17bdf847c7888343dd529e6a", @typed={0x8, 0xff, 0x0, 0x0, @fd}, @generic="67924b0b1ca4b6183a346e40238965ab7d68046fcff4a8fbb736c441a13275e49addfa4a86719743fb7e3c3598e5274182940434e376b01b0a778109f4b0fc63f4e580ea34847c22a048986dcd340d3f2594fc8c127d979d84da1020a4291ab2516189ad63c7a565c14be3c4099b800e78cde83eb15e42d1c8"]}, @nested={0x4, 0x1c}, @nested={0x8c, 0xd1, 0x0, 0x1, [@typed={0x55, 0xb6, 0x0, 0x0, @binary="0635cbcf8310e99050b0e12d2f3e1b8582b2e950b7803d283738a86a8644fa6b8faad405b20e508a3cd894f0c114c9594497d7bbc17304edcd52e656fec316adad664d773323c8a763926ae7a7e5b33c0b"}, @typed={0x2d, 0x36, 0x0, 0x0, @binary="a1eca3e51d14a9fb032a1bc04e793aa333d524af9aa89a72aea3186997693f6d01399ba6a66c822402"}]}]}, 0x390}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-mmap-syz_open_procfs-lseek-getdents64
detailed listing:
executing program 0:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 9, 9, 9, 9, 9, 9, 5, 5, 5, 5, 5, 5, 5, 5, 5, 17, 5, 5, 20, 5, 5, 5, 15, 5, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10)
listen(r0, 0x5)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10)
r2 = accept(r0, 0x0, 0x0)
setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000080)='espintcp\x00', 0x9)
sendto(r1, &(0x7f0000000100)='\x00\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xa, 0x0, 0x0, 0x0)
recvfrom(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x25000, 0x4, 0xe, 0xf1, 0x3, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0xf7, 0x4f}, {0xf000, 0x0, 0xd, 0x19, 0x8, 0x3, 0x6, 0xb, 0x7, 0xf, 0x3, 0xc0}, {0x8080000, 0x26000, 0xb, 0x2, 0x2, 0x5, 0x24, 0x9, 0x5, 0x96, 0xc4, 0x15}, {0x60000, 0x9000, 0x4, 0xf8, 0x3, 0x68, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x1, 0xa000, 0x9, 0x1, 0x3, 0x9, 0xd, 0x6, 0x5, 0x9, 0x2e, 0x4b}, {0x6000, 0xeeee0000, 0xa, 0x9, 0x3, 0x1, 0x1, 0xc6, 0x4, 0x90, 0x1, 0xfc}, {0xffffffff, 0x4000, 0xf, 0xff, 0x3, 0xfb, 0x0, 0xb, 0x1, 0x7, 0x43, 0xfc}, {0xf7f63004, 0x1, 0xf, 0x4, 0xfc, 0x3, 0xa, 0x1, 0x54, 0x1, 0xff, 0x5}, {0xeeef0000, 0x3}, {0x80a0000, 0x9}, 0x4005001d, 0x0, 0xffff1000, 0x40310, 0x5, 0x2100, 0xe6e70c00, [0x3, 0x20000401, 0x8, 0xc5]})
memfd_create(&(0x7f0000000000)='-&:{-\xaa]{\x00', 0x2)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0xb, 0xe, '\x00', 0xc2})
ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000000)={0x8000000, 0xffff1000, 0x1, 0x1, 0x999})
executing program 0:
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0)
r0 = creat(&(0x7f0000000540)='./file0\x00', 0x0)
close(r0)
landlock_create_ruleset(0x0, 0x0, 0x2)
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 0:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d3", 0xfb}], 0x1}, 0x84)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100003800c"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000200)={'syzkaller1\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x1}}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff00000007058102"], 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_ep_write(r1, 0x81, 0x1, &(0x7f0000000700)='\x00')
read$char_usb(r2, &(0x7f0000000600)=""/64, 0x40)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c36302725166")
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r3, 0x0, 0x18)
executing program 0:
sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000)
socket$packet(0x11, 0xa, 0x300)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x3c)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff2"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1)
executing program 32:
sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000)
socket$packet(0x11, 0xa, 0x300)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x3c)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff2"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./gadgetfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./gadgetfs\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadgetfs/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000400)="000000000902190001010080010904000001ffffff000705810240000012011001000000402505a0a4000000000001", 0x2f)
read(r0, &(0x7f0000000500), 0x10)
executing program 1:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
r0 = syz_usb_connect$uac2(0x5, 0xa0, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x15, 0x7}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100fdffffbf00010000e0000002000000080000000000000000ffffffff000000000000000000000000000329944e230020020000003c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="7f000001000000000000000000000000000004d36c00000000000000000000000000ffffac141418000000000000000009000000000000000600000000000000ffff0000000000001c25080000000000020000000000000083000000000000000000000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000002000000fcffffff000000002cbd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x20000810)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {}, 0x0, 0x0, 0x1}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x41}, 0x4d3, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x3, 0x0, 0x0, 0x400000}}, 0xe8)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0xfd, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x40, @multicast2}}, {{0x2, 0x400, @loopback}}}, 0x108)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000700)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108)
r1 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00')
preadv(r1, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/93, 0x5d}], 0x1, 0x0, 0x0)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x6)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
executing program 1:
r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, 0x0, 0x4008094)
write$FUSE_INTERRUPT(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x53, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0xa6, 0x80, 0xe1, 0x40, 0x1199, 0x6804, 0x9714, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0x3c, 0x0, 0x6, "", [{{0x9, 0x4, 0xef, 0xc6, 0x5, 0xbb, 0x57, 0x13, 0x3, [], [{{0x9, 0x5, 0xf, 0x10, 0x440, 0x4, 0x4, 0x9}}, {{0x9, 0x5, 0x5, 0x0, 0x10, 0x3, 0xe, 0x9, [@generic={0x2, 0x9}]}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x5, 0xf2, 0x4}}, {{0x9, 0x5, 0x4, 0x2, 0x200, 0x81, 0x6}}, {{0x9, 0x5, 0xc, 0x0, 0x20, 0x6, 0x5, 0xa}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='10', 0x2)
write$binfmt_misc(r0, 0x0, 0x0)
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x184, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa67", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c", @nested={0x51, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765"]}, @nested={0x55, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64", @typed={0x8, 0xff, 0x0, 0x0, @fd}]}]}, 0x184}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000180)=0xde)
executing program 4:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/12, 0xc)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x390, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa6753", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c0b8246c6b87fd89f3f956f888c49dc151b2c259d244855622d00eaf5297e8f6476b0add6f25110be6a3bd1f0e0a5cadf1a2276b0ccef4927b7a9e8184e52bf5b84e179feea7ba7d1c69006b02687c4ac99ea0b1ef301ace51ffe2d52b7296ed8d447fc90", @nested={0xa1, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765b37d127fb22369919cc2f1ce6f42fb1e70e750eb7d0f3e4e55c6db8241f4f9f6a9a2a06d5c87d3d4e2e7f160a5ff288bfae1bbdab738266ea5add0d9e0389b9c747c23ce874f6d558289d7073939016e"]}, @generic="af600e2d6428734e419378d87ba8997f836a8a15501437a011c5e77f10b2a15491db405e0b4d83d0051c7665556b27760995551a35fd43c81c8a63", @nested={0xe1, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64c36be58fef628e17bdf847c7888343dd529e6a", @typed={0x8, 0xff, 0x0, 0x0, @fd}, @generic="67924b0b1ca4b6183a346e40238965ab7d68046fcff4a8fbb736c441a13275e49addfa4a86719743fb7e3c3598e5274182940434e376b01b0a778109f4b0fc63f4e580ea34847c22a048986dcd340d3f2594fc8c127d979d84da1020a4291ab2516189ad63c7a565c14be3c4099b800e78cde83eb15e42d1c8"]}, @nested={0x4, 0x1c}, @nested={0x8c, 0xd1, 0x0, 0x1, [@typed={0x55, 0xb6, 0x0, 0x0, @binary="0635cbcf8310e99050b0e12d2f3e1b8582b2e950b7803d283738a86a8644fa6b8faad405b20e508a3cd894f0c114c9594497d7bbc17304edcd52e656fec316adad664d773323c8a763926ae7a7e5b33c0b"}, @typed={0x2d, 0x36, 0x0, 0x0, @binary="a1eca3e51d14a9fb032a1bc04e793aa333d524af9aa89a72aea3186997693f6d01399ba6a66c822402"}]}]}, 0x390}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: bisecting 31 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 17, 5, 5, 20, 5, 5, 5, 15, 5, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100fdffffbf00010000e0000002000000080000000000000000ffffffff000000000000000000000000000329944e230020020000003c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="7f000001000000000000000000000000000004d36c00000000000000000000000000ffffac141418000000000000000009000000000000000600000000000000ffff0000000000001c25080000000000020000000000000083000000000000000000000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000002000000fcffffff000000002cbd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x20000810)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {}, 0x0, 0x0, 0x1}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x41}, 0x4d3, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x3, 0x0, 0x0, 0x400000}}, 0xe8)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0xfd, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x40, @multicast2}}, {{0x2, 0x400, @loopback}}}, 0x108)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000700)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108)
r1 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00')
preadv(r1, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/93, 0x5d}], 0x1, 0x0, 0x0)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x6)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
executing program 1:
r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, 0x0, 0x4008094)
write$FUSE_INTERRUPT(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x53, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0xa6, 0x80, 0xe1, 0x40, 0x1199, 0x6804, 0x9714, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0x3c, 0x0, 0x6, "", [{{0x9, 0x4, 0xef, 0xc6, 0x5, 0xbb, 0x57, 0x13, 0x3, [], [{{0x9, 0x5, 0xf, 0x10, 0x440, 0x4, 0x4, 0x9}}, {{0x9, 0x5, 0x5, 0x0, 0x10, 0x3, 0xe, 0x9, [@generic={0x2, 0x9}]}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x5, 0xf2, 0x4}}, {{0x9, 0x5, 0x4, 0x2, 0x200, 0x81, 0x6}}, {{0x9, 0x5, 0xc, 0x0, 0x20, 0x6, 0x5, 0xa}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='10', 0x2)
write$binfmt_misc(r0, 0x0, 0x0)
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x184, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa67", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c", @nested={0x51, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765"]}, @nested={0x55, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64", @typed={0x8, 0xff, 0x0, 0x0, @fd}]}]}, 0x184}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000180)=0xde)
executing program 4:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/12, 0xc)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x390, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa6753", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c0b8246c6b87fd89f3f956f888c49dc151b2c259d244855622d00eaf5297e8f6476b0add6f25110be6a3bd1f0e0a5cadf1a2276b0ccef4927b7a9e8184e52bf5b84e179feea7ba7d1c69006b02687c4ac99ea0b1ef301ace51ffe2d52b7296ed8d447fc90", @nested={0xa1, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765b37d127fb22369919cc2f1ce6f42fb1e70e750eb7d0f3e4e55c6db8241f4f9f6a9a2a06d5c87d3d4e2e7f160a5ff288bfae1bbdab738266ea5add0d9e0389b9c747c23ce874f6d558289d7073939016e"]}, @generic="af600e2d6428734e419378d87ba8997f836a8a15501437a011c5e77f10b2a15491db405e0b4d83d0051c7665556b27760995551a35fd43c81c8a63", @nested={0xe1, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64c36be58fef628e17bdf847c7888343dd529e6a", @typed={0x8, 0xff, 0x0, 0x0, @fd}, @generic="67924b0b1ca4b6183a346e40238965ab7d68046fcff4a8fbb736c441a13275e49addfa4a86719743fb7e3c3598e5274182940434e376b01b0a778109f4b0fc63f4e580ea34847c22a048986dcd340d3f2594fc8c127d979d84da1020a4291ab2516189ad63c7a565c14be3c4099b800e78cde83eb15e42d1c8"]}, @nested={0x4, 0x1c}, @nested={0x8c, 0xd1, 0x0, 0x1, [@typed={0x55, 0xb6, 0x0, 0x0, @binary="0635cbcf8310e99050b0e12d2f3e1b8582b2e950b7803d283738a86a8644fa6b8faad405b20e508a3cd894f0c114c9594497d7bbc17304edcd52e656fec316adad664d773323c8a763926ae7a7e5b33c0b"}, @typed={0x2d, 0x36, 0x0, 0x0, @binary="a1eca3e51d14a9fb032a1bc04e793aa333d524af9aa89a72aea3186997693f6d01399ba6a66c822402"}]}]}, 0x390}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 15, 5, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x184, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa67", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c", @nested={0x51, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765"]}, @nested={0x55, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64", @typed={0x8, 0xff, 0x0, 0x0, @fd}]}]}, 0x184}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000180)=0xde)
executing program 4:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/12, 0xc)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x390, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa6753", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c0b8246c6b87fd89f3f956f888c49dc151b2c259d244855622d00eaf5297e8f6476b0add6f25110be6a3bd1f0e0a5cadf1a2276b0ccef4927b7a9e8184e52bf5b84e179feea7ba7d1c69006b02687c4ac99ea0b1ef301ace51ffe2d52b7296ed8d447fc90", @nested={0xa1, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765b37d127fb22369919cc2f1ce6f42fb1e70e750eb7d0f3e4e55c6db8241f4f9f6a9a2a06d5c87d3d4e2e7f160a5ff288bfae1bbdab738266ea5add0d9e0389b9c747c23ce874f6d558289d7073939016e"]}, @generic="af600e2d6428734e419378d87ba8997f836a8a15501437a011c5e77f10b2a15491db405e0b4d83d0051c7665556b27760995551a35fd43c81c8a63", @nested={0xe1, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64c36be58fef628e17bdf847c7888343dd529e6a", @typed={0x8, 0xff, 0x0, 0x0, @fd}, @generic="67924b0b1ca4b6183a346e40238965ab7d68046fcff4a8fbb736c441a13275e49addfa4a86719743fb7e3c3598e5274182940434e376b01b0a778109f4b0fc63f4e580ea34847c22a048986dcd340d3f2594fc8c127d979d84da1020a4291ab2516189ad63c7a565c14be3c4099b800e78cde83eb15e42d1c8"]}, @nested={0x4, 0x1c}, @nested={0x8c, 0xd1, 0x0, 0x1, [@typed={0x55, 0xb6, 0x0, 0x0, @binary="0635cbcf8310e99050b0e12d2f3e1b8582b2e950b7803d283738a86a8644fa6b8faad405b20e508a3cd894f0c114c9594497d7bbc17304edcd52e656fec316adad664d773323c8a763926ae7a7e5b33c0b"}, @typed={0x2d, 0x36, 0x0, 0x0, @binary="a1eca3e51d14a9fb032a1bc04e793aa333d524af9aa89a72aea3186997693f6d01399ba6a66c822402"}]}]}, 0x390}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 17, 5, 5, 20, 5]
detailed listing:
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100fdffffbf00010000e0000002000000080000000000000000ffffffff000000000000000000000000000329944e230020020000003c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="7f000001000000000000000000000000000004d36c00000000000000000000000000ffffac141418000000000000000009000000000000000600000000000000ffff0000000000001c25080000000000020000000000000083000000000000000000000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000002000000fcffffff000000002cbd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x20000810)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {}, 0x0, 0x0, 0x1}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x41}, 0x4d3, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x3, 0x0, 0x0, 0x400000}}, 0xe8)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0xfd, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x40, @multicast2}}, {{0x2, 0x400, @loopback}}}, 0x108)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000700)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108)
r1 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00')
preadv(r1, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/93, 0x5d}], 0x1, 0x0, 0x0)
executing program 3:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x6)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
executing program 1:
r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, 0x0, 0x4008094)
write$FUSE_INTERRUPT(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x53, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0xa6, 0x80, 0xe1, 0x40, 0x1199, 0x6804, 0x9714, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0x3c, 0x0, 0x6, "", [{{0x9, 0x4, 0xef, 0xc6, 0x5, 0xbb, 0x57, 0x13, 0x3, [], [{{0x9, 0x5, 0xf, 0x10, 0x440, 0x4, 0x4, 0x9}}, {{0x9, 0x5, 0x5, 0x0, 0x10, 0x3, 0xe, 0x9, [@generic={0x2, 0x9}]}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x5, 0xf2, 0x4}}, {{0x9, 0x5, 0x4, 0x2, 0x200, 0x81, 0x6}}, {{0x9, 0x5, 0xc, 0x0, 0x20, 0x6, 0x5, 0xa}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='10', 0x2)
write$binfmt_misc(r0, 0x0, 0x0)
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)

program did not crash
bisect: split chunks (needed=true): <10>, <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17, 5, 5, 20, 5, 5, 5, 15, 5, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x184, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa67", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c", @nested={0x51, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765"]}, @nested={0x55, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64", @typed={0x8, 0xff, 0x0, 0x0, @fd}]}]}, 0x184}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000180)=0xde)
executing program 4:
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @local, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x74}, {@remote, 0x4e20, 0x4, 0x6, 0x1}}, 0x44)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/12, 0xc)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000280)={0x390, 0x27, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@generic="3e6c4f5934af26ef87440d1b0c1fd427f3651013fffc8be2f5abcd99697d1e34c658f4d90f70a2651ceaef4c76f68755bb8f4f2d8bbbf6e36be5589e92366617cadca46098963c3a6de5fee7a4bc7da7f876ecda56f2a3a6e404a0e4d129e774aa6753", @generic="9b836c783902bbd563d151136446e02382bc49e476b760ad9a51db43ea445d0505eb938e8ff2dbd151169e61c095fbb68ade124819ebee2abd27cc5f5a7e862ff9402dd678c9df321e26ffd7e7840fc4982cb50ab515bd3784992e21e3a4105823d42c0b8246c6b87fd89f3f956f888c49dc151b2c259d244855622d00eaf5297e8f6476b0add6f25110be6a3bd1f0e0a5cadf1a2276b0ccef4927b7a9e8184e52bf5b84e179feea7ba7d1c69006b02687c4ac99ea0b1ef301ace51ffe2d52b7296ed8d447fc90", @nested={0xa1, 0x59, 0x0, 0x1, [@generic="ce7c669dd37638aad86b13116f29bd65d6118a88024b4d44a82c2e1b92abce34399b919cffb358e6926480996bef5fdd4a6a4f7d855ec55ba122dc4bc26a384db2728713fba236e54483832765b37d127fb22369919cc2f1ce6f42fb1e70e750eb7d0f3e4e55c6db8241f4f9f6a9a2a06d5c87d3d4e2e7f160a5ff288bfae1bbdab738266ea5add0d9e0389b9c747c23ce874f6d558289d7073939016e"]}, @generic="af600e2d6428734e419378d87ba8997f836a8a15501437a011c5e77f10b2a15491db405e0b4d83d0051c7665556b27760995551a35fd43c81c8a63", @nested={0xe1, 0x11d, 0x0, 0x1, [@generic="6b5a76f7459ced2b193bae23e13e26c1c8851cd0d0f401de30e0ce9ff2f433e48bd9b682492d6e0a9eb624de04e056d48659bc402e04692a64eec76f9aa678", @generic="a3d7b8ea41596fb98f64c36be58fef628e17bdf847c7888343dd529e6a", @typed={0x8, 0xff, 0x0, 0x0, @fd}, @generic="67924b0b1ca4b6183a346e40238965ab7d68046fcff4a8fbb736c441a13275e49addfa4a86719743fb7e3c3598e5274182940434e376b01b0a778109f4b0fc63f4e580ea34847c22a048986dcd340d3f2594fc8c127d979d84da1020a4291ab2516189ad63c7a565c14be3c4099b800e78cde83eb15e42d1c8"]}, @nested={0x4, 0x1c}, @nested={0x8c, 0xd1, 0x0, 0x1, [@typed={0x55, 0xb6, 0x0, 0x0, @binary="0635cbcf8310e99050b0e12d2f3e1b8582b2e950b7803d283738a86a8644fa6b8faad405b20e508a3cd894f0c114c9594497d7bbc17304edcd52e656fec316adad664d773323c8a763926ae7a7e5b33c0b"}, @typed={0x2d, 0x36, 0x0, 0x0, @binary="a1eca3e51d14a9fb032a1bc04e793aa333d524af9aa89a72aea3186997693f6d01399ba6a66c822402"}]}]}, 0x390}], 0x1}, 0x20040000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17, 5, 5, 20, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 20, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 3:
creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145)
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108)
eventfd(0x5f0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
capset(0x0, &(0x7f0000000040)={0x200000, 0x200000})
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17, 5, 5, 5, 5, 5, 5, 5]
detailed listing:
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 4:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x0, 0xd, 0x21, {0x21, 0x5, "a64b317b19e9485d7fade1370828f30109a8dddb0944e97e19366095d76092"}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0)
mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil)
executing program 2:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0, 0x1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x2, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17, 5, 5, 5, 5]
detailed listing:
executing program 2:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c, 0x0}}], 0x1, 0x931766f6319eed40)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
mkdirat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff)
unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700), 0x0)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/31, 0x1f)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
write(r0, &(0x7f0000000700)='\x00'/32, 0x20)
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <3>, <2>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 2:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0})

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 3 programs left: 

executing program 2:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xf}, 0x0, 0x0})
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")


bisect: trying to concatenate
bisect: concatenate 3 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5, 5]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 5, 5]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5, 5]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5, 5]
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 5]
detailed listing:
executing program 0:
executing program 1:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x43)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
minimized 5 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 5]
detailed listing:
executing program 2:
executing program 0:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r0, 0x4, 0x1)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 5]
detailed listing:
executing program 2:
executing program 0:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 5]
detailed listing:
executing program 2:
executing program 0:
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 1, 5]
detailed listing:
executing program 2:
executing program 0:
sched_setscheduler(0x0, 0x2, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 5]
detailed listing:
executing program 2:
executing program 0:
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
minimized 5 calls -> 0 calls
minimizing program #2 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4]
detailed listing:
executing program 2:
executing program 1:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4]
detailed listing:
executing program 2:
executing program 1:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl(0xffffffffffffffff, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4]
detailed listing:
executing program 2:
executing program 1:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl(r0, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4]
detailed listing:
executing program 2:
executing program 1:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl(r1, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4]
detailed listing:
executing program 2:
executing program 1:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
minimized 5 calls -> 5 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: WARNING: suspicious RCU usage in kvm_xen_set_evtchn_fast
bisect: concatenation succeeded
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl(0xffffffffffffffff, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl(r0, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl(r1, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, 0x0)

program did not crash
testing program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100))

program did not crash
extracting C reproducer
testing compiled C program (duration=1m56.120575298s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
simplifying C reproducer
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program did not crash
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing compiled C program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
testing program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
validation run: crashed=true
testing program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
validation run: crashed=true
testing program (duration=1m56.120575298s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")

program crashed: BUG: sleeping function called from invalid context in kvm_xen_set_evtchn_fast
validation run: crashed=true
reproducing took 1h52m28.4383252s
repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:248
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 16, name: ktimers/0
preempt_count: 10001, expected: 0
RCU nest depth: 0, expected: 0
locks held by ktimers/0/16: 1, last CPU#0:
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1827
irq event stamp: 159030
hardirqs last  enabled at (159029): [<ffffffff81950ce2>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1684 [inline]
hardirqs last  enabled at (159029): [<ffffffff81950ce2>] finish_lock_switch kernel/sched/core.c:5241 [inline]
hardirqs last  enabled at (159029): [<ffffffff81950ce2>] finish_task_switch+0x412/0xc60 kernel/sched/core.c:5359
hardirqs last disabled at (159030): [<ffffffff8b501aee>] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062
softirqs last  enabled at (159026): [<ffffffff8188647b>] ksoftirqd_run_end kernel/softirq.c:325 [inline]
softirqs last  enabled at (159026): [<ffffffff8188647b>] run_ktimerd+0x8b/0x100 kernel/softirq.c:1157
softirqs last disabled at (158996): [<ffffffff819299fc>] smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
Preemption disabled at:
[<ffffffff8b51547d>] __schedule_loop kernel/sched/core.c:7307 [inline]
[<ffffffff8b51547d>] schedule+0x15d/0x2b0 kernel/sched/core.c:7323
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x329/0x480 kernel/sched/core.c:9194
 rt_read_lock+0xa9/0x4b0 kernel/locking/spinlock_rt.c:248
 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829
 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:141
 __run_hrtimer kernel/time/hrtimer.c:2065 [inline]
 __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2122
 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2241
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch+0x417/0xc60 kernel/sched/core.c:5361
Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 c3 a6 be 09 e8 ee d3 38 00 fb 4c 8b 65 c8 <49> 8d bc 24 f0 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc90000157ae0 EFLAGS: 00000206
RAX: 0000000000026d35 RBX: ffff8880b863c6a0 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff8d98ba58 RDI: ffffffff8bcbd080
RBP: ffffc90000157b30 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88801daf0000
R13: ffff88801daf0000 R14: dffffc0000000000 R15: 1ffff110170c78d4
 context_switch kernel/sched/core.c:5513 [inline]
 __schedule+0x1711/0x5530 kernel/sched/core.c:7231
 __schedule_loop kernel/sched/core.c:7308 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7323
 smpboot_thread_fn+0x5f9/0xa80 kernel/smpboot.c:156
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G        W          
-----------------------------
ktimers/0/16 is trying to lock:
ffff88805d431530 (&gpc->lock){.+.+}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829
other info that might help us debug this:
context-{2:2}
locks held by ktimers/0/16: 1, last CPU#0:
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1827
stack backtrace:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G        W           syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4846 [inline]
 check_wait_context kernel/locking/lockdep.c:4918 [inline]
 __lock_acquire+0xef0/0x2e40 kernel/locking/lockdep.c:5204
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
 rt_read_lock+0xcc/0x4b0 kernel/locking/spinlock_rt.c:249
 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829
 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:141
 __run_hrtimer kernel/time/hrtimer.c:2065 [inline]
 __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2122
 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2241
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch+0x417/0xc60 kernel/sched/core.c:5361
Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 c3 a6 be 09 e8 ee d3 38 00 fb 4c 8b 65 c8 <49> 8d bc 24 f0 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc90000157ae0 EFLAGS: 00000206
RAX: 0000000000026d35 RBX: ffff8880b863c6a0 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff8d98ba58 RDI: ffffffff8bcbd080
RBP: ffffc90000157b30 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88801daf0000
R13: ffff88801daf0000 R14: dffffc0000000000 R15: 1ffff110170c78d4
 context_switch kernel/sched/core.c:5513 [inline]
 __schedule+0x1711/0x5530 kernel/sched/core.c:7231
 __schedule_loop kernel/sched/core.c:7308 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7323
 smpboot_thread_fn+0x5f9/0xa80 kernel/smpboot.c:156
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	41 c7 84 24 20 0e 00 	movl   $0x0,0xe20(%r12)
   9:	00 00 00 00 00
   e:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  13:	49 83 c4 48          	add    $0x48,%r12
  17:	4c 89 e7             	mov    %r12,%rdi
  1a:	e8 c3 a6 be 09       	call   0x9bea6e2
  1f:	e8 ee d3 38 00       	call   0x38d412
  24:	fb                   	sti
  25:	4c 8b 65 c8          	mov    -0x38(%rbp),%r12
* 29:	49 8d bc 24 f0 16 00 	lea    0x16f0(%r12),%rdi <-- trapping instruction
  30:	00
  31:	48 89 f8             	mov    %rdi,%rax
  34:	48 c1 e8 03          	shr    $0x3,%rax
  38:	42 0f b6 04 30       	movzbl (%rax,%r14,1),%eax
  3d:	84 c0                	test   %al,%al

final repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:248
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 16, name: ktimers/0
preempt_count: 10001, expected: 0
RCU nest depth: 0, expected: 0
locks held by ktimers/0/16: 1, last CPU#0:
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1827
irq event stamp: 159030
hardirqs last  enabled at (159029): [<ffffffff81950ce2>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1684 [inline]
hardirqs last  enabled at (159029): [<ffffffff81950ce2>] finish_lock_switch kernel/sched/core.c:5241 [inline]
hardirqs last  enabled at (159029): [<ffffffff81950ce2>] finish_task_switch+0x412/0xc60 kernel/sched/core.c:5359
hardirqs last disabled at (159030): [<ffffffff8b501aee>] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062
softirqs last  enabled at (159026): [<ffffffff8188647b>] ksoftirqd_run_end kernel/softirq.c:325 [inline]
softirqs last  enabled at (159026): [<ffffffff8188647b>] run_ktimerd+0x8b/0x100 kernel/softirq.c:1157
softirqs last disabled at (158996): [<ffffffff819299fc>] smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
Preemption disabled at:
[<ffffffff8b51547d>] __schedule_loop kernel/sched/core.c:7307 [inline]
[<ffffffff8b51547d>] schedule+0x15d/0x2b0 kernel/sched/core.c:7323
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x329/0x480 kernel/sched/core.c:9194
 rt_read_lock+0xa9/0x4b0 kernel/locking/spinlock_rt.c:248
 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829
 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:141
 __run_hrtimer kernel/time/hrtimer.c:2065 [inline]
 __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2122
 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2241
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch+0x417/0xc60 kernel/sched/core.c:5361
Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 c3 a6 be 09 e8 ee d3 38 00 fb 4c 8b 65 c8 <49> 8d bc 24 f0 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc90000157ae0 EFLAGS: 00000206
RAX: 0000000000026d35 RBX: ffff8880b863c6a0 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff8d98ba58 RDI: ffffffff8bcbd080
RBP: ffffc90000157b30 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88801daf0000
R13: ffff88801daf0000 R14: dffffc0000000000 R15: 1ffff110170c78d4
 context_switch kernel/sched/core.c:5513 [inline]
 __schedule+0x1711/0x5530 kernel/sched/core.c:7231
 __schedule_loop kernel/sched/core.c:7308 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7323
 smpboot_thread_fn+0x5f9/0xa80 kernel/smpboot.c:156
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G        W          
-----------------------------
ktimers/0/16 is trying to lock:
ffff88805d431530 (&gpc->lock){.+.+}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829
other info that might help us debug this:
context-{2:2}
locks held by ktimers/0/16: 1, last CPU#0:
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #0: ffff88805d431b48 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1827
stack backtrace:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G        W           syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4846 [inline]
 check_wait_context kernel/locking/lockdep.c:4918 [inline]
 __lock_acquire+0xef0/0x2e40 kernel/locking/lockdep.c:5204
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
 rt_read_lock+0xcc/0x4b0 kernel/locking/spinlock_rt.c:249
 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829
 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:141
 __run_hrtimer kernel/time/hrtimer.c:2065 [inline]
 __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2122
 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2241
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch+0x417/0xc60 kernel/sched/core.c:5361
Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 c3 a6 be 09 e8 ee d3 38 00 fb 4c 8b 65 c8 <49> 8d bc 24 f0 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc90000157ae0 EFLAGS: 00000206
RAX: 0000000000026d35 RBX: ffff8880b863c6a0 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff8d98ba58 RDI: ffffffff8bcbd080
RBP: ffffc90000157b30 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88801daf0000
R13: ffff88801daf0000 R14: dffffc0000000000 R15: 1ffff110170c78d4
 context_switch kernel/sched/core.c:5513 [inline]
 __schedule+0x1711/0x5530 kernel/sched/core.c:7231
 __schedule_loop kernel/sched/core.c:7308 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7323
 smpboot_thread_fn+0x5f9/0xa80 kernel/smpboot.c:156
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	41 c7 84 24 20 0e 00 	movl   $0x0,0xe20(%r12)
   9:	00 00 00 00 00
   e:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  13:	49 83 c4 48          	add    $0x48,%r12
  17:	4c 89 e7             	mov    %r12,%rdi
  1a:	e8 c3 a6 be 09       	call   0x9bea6e2
  1f:	e8 ee d3 38 00       	call   0x38d412
  24:	fb                   	sti
  25:	4c 8b 65 c8          	mov    -0x38(%rbp),%r12
* 29:	49 8d bc 24 f0 16 00 	lea    0x16f0(%r12),%rdi <-- trapping instruction
  30:	00
  31:	48 89 f8             	mov    %rdi,%rax
  34:	48 c1 e8 03          	shr    $0x3,%rax
  38:	42 0f b6 04 30       	movzbl (%rax,%r14,1),%eax
  3d:	84 c0                	test   %al,%al