Extracting prog: 4m8.071206338s Minimizing prog: 36m10.942416062s Simplifying prog options: 5m21.554231254s Extracting C: 1m46.03197644s Simplifying C: 0s extracting reproducer from 31 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL-gettid-timer_create-openat$vhost_vsock-timer_settime-mkdirat detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000580)="e4995c8f12f32ed7d3313b", &(0x7f0000000600)="34bea38afb"}}, &(0x7f0000000140)=0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x77359400}}, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 31 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 2, 1, 30, 32, 7, 7, 9, 6, 3, 4, 2, 26, 21, 2, 2, 3, 40, 6, 2, 4, 4, 12, 7, 14, 3, 4, 22, 2, 3, 29] detailed listing: executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="00b2985d3a7ab0", 0x7}], 0x1}, 0x4) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2c, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffe0, 0xa}, {0x1, 0xe}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x55}, 0xc010) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getstats={0x1c, 0x5e, 0x100, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r4, 0x5}}, 0x1c}}, 0x40c1) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001340)=ANY=[@ANYBLOB="5c0100001000010000000000fdfffffffe8800000000000000000000000000010000000000000000000000000000000000000000000004000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000a0000008a000000000000001c0017000000000000000000ffffffff00000000ffffffff0400000048000100736861323536"], 0x15c}}, 0x0) executing program 2: syz_emit_ethernet(0x5e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6008100000282b0000000000000000000000ffffac1414bbfe8000000000000000000000000500aa3a020201"], 0x0) executing program 2: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x4}, [@ldst={0x2, 0x3, 0x3, 0x8, 0xa, 0xfffffffffffffffe, 0x1}]}, &(0x7f00000005c0)='GPL\x00'}, 0x94) r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x3a, &(0x7f00000001c0)={@local, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x20, 0x0, 0x0, 0x11, 0x0, @private, @empty}, {0x0, 0x17c1, 0x18, 0x0, @wg=@data={0x4, 0xc}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x18) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f0000000000)='7', 0x1) listen(r3, 0x2) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000500)='./file0/file0\x00', 0x0, 0x185093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11058c2, 0x0) umount2(&(0x7f00000001c0)='./file0/../file0\x00', 0xa) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000005c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x8, 0x0, r5, 0x0, 0x0, 0x0, 0x40002022}) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f00000002c0)=""/126, &(0x7f0000000440)=0x7e) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r6, 0x18, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0xc, {0xfff, 0x7}}, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000240)={&(0x7f0000000280)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r10}]}, 0x28}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x35, &(0x7f0000000400)=ANY=[@ANYBLOB="0180c2000000020000000001002742420300"/49], 0x0) mount$overlay(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x200000, &(0x7f0000000640)={[{@redirect_dir_follow}, {@redirect_dir_follow}, {@redirect_dir_off}], [{@fsuuid={'fsuuid', 0x3d, {[0x31, 0x61, 0x62, 0x65, 0x34, 0x37, 0x62, 0x61], 0x2d, [0x30, 0x61, 0x39, 0x61], 0x2d, [0x64, 0x66, 0x61, 0x35], 0x2d, [0x419f9ed304a5e9ba, 0x63, 0x61, 0x61], 0x2d, [0x31, 0x36, 0x36, 0x63, 0x33, 0x36, 0x37, 0x63]}}}, {@smackfsdef={'smackfsdef', 0x3d, '}]^'}}, {@measure}]}) executing program 2: setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x21, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_open_dev$video(&(0x7f0000000000), 0x101, 0xab02) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, &(0x7f0000000000)={{&(0x7f000023c000/0x4000)=nil, 0x4000}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000100), 0x12) listen(r1, 0x1) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b007e"], 0x97) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) setns(0xc9, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) (async) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) (async) syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x21, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) syz_open_dev$video(&(0x7f0000000000), 0x101, 0xab02) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) (async) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, &(0x7f0000000000)={{&(0x7f000023c000/0x4000)=nil, 0x4000}}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) bind$x25(r1, &(0x7f0000000100), 0x12) (async) listen(r1, 0x1) (async) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b007e"], 0x97) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) close(0x3) (async) executing program 2: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) executing program 32: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0xc0) write(r0, &(0x7f0000000280)='0', 0x1) r1 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x38000000) executing program 3: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0x4, 0x8, 0xfe, 0xfffffffe, 0x80000000, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x7, 0x9, 0xffff2d37, 0xff, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xfeffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c70, 0x80000000, 0x242, 0x8, 0xe, 0x4, 0x80008071, 0xffffb8f3, 0x17, 0x6, 0x7, 0x5, 0x3e, 0x8f, 0x8, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x4, 0x4, 0x0, 0xfffffffa], [0x1000, 0x9, 0x8000012f, 0x8004, 0x5, 0x5, 0x129432e7, 0x46, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x0, 0x7, 0xc2bf, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c7, 0xd, 0x4de, 0x0, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x389, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c9368d, 0x80, 0x3], [0x4, 0xc08, 0x4, 0x5, 0xfffffffd, 0xd, 0x31b, 0x9, 0x5, 0x7fff, 0x9, 0x6, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xe, 0x5, 0x0, 0x2, 0xda6, 0xc, 0x4, 0x6d01, 0x2, 0x38, 0x800003, 0x200, 0x80, 0x7, 0x4, 0x2950bfb1, 0x1000, 0x400000a2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x9, 0x3, 0x0, 0x10000, 0x104, 0x37f3, 0xffff, 0xa622, 0x1, 0x5, 0x1, 0xffffffff, 0x14f, 0x4, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x4, 0x4, 0x4c7, 0x1, 0xfffff000, 0x7, 0x5, 0x7e, 0x100, 0x3173, 0x40000047, 0xb2, 0x8, 0x6, 0x10, 0x5, 0x5, 0x8, 0x30b1d693, 0x4008a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0x0, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFC_CMD_SE_IO(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008f00540000000020900020073797a310000000008000a"], 0xb0}, 0x1, 0x0, 0x0, 0x14}, 0x40) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010000003000000000000000000000010", @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800b0001006272696467650000100002800c0021"], 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a000f0076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a010800000000000000000700ffff0900010073797a300000000040000000030a01040000000000000000050000000900010073797a30000000000900030073797a300000000014000480080001400000000008000240ffffff3864000000060a01040000000000000000070000000900010073797a30000000000900020073797a30000000003800048034000180090001006d65746100000000240002800800014000000001080002400000001108"], 0xec}}, 0x0) executing program 4: r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xbffffe, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r1}, 0x0, 0x0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r0, 0x0, 0x0, 0x702c71ba5eecaaed}, 0x15) fcntl$getown(r0, 0x9) r2 = fsopen(&(0x7f0000000080)='mqueue\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x8, 0x0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0xff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x80) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r8 = socket$netlink(0x10, 0x3, 0x0) splice(r7, 0x0, r8, 0x0, 0x10d00, 0xf) ioctl$CDROM_GET_CAPABILITY(r7, 0x5331) r9 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x7a, &(0x7f0000000280)=ANY=[@ANYBLOB="856b934629faaaaaaaaaaaaa86dd60381f3400142f00fc000000000000000000000000000000ff020000000000000000000000000001042081000030c25817000800000086dd88a888be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000"], 0x0) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r9, &(0x7f00000002c0)="05031200d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x8100, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000004500), 0xc00, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r2, @ANYRESHEX=r3], 0x15) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x0) r4 = dup(r0) getsockopt$XDP_STATISTICS(r4, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000080)=0x30) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x34000) setns(0xc9, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="dc000000", @ANYRES16=r6, @ANYBLOB="c9472bbd7000fbdbdf2415000000180001801400020073797a6b616c6c6572310000000000005800018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="14000200626f6e645f736c6176655f30000000008cfd020073797a6b616c6c657230000000000000140002006e69637666300000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="5800018008000100", @ANYRES32=0x0, @ANYBLOB="080003000000000014000200776c616e300000000000000000000000080003e76693001f08000100", @ANYRES32=0x0, @ANYBLOB="080003000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB], 0xdc}, 0x1, 0x0, 0x0, 0x4048084}, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x80, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x54, 0x3, 0x0, 0x1, [{0x50, 0x3fff, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x44, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x6fbc}]}}}, {0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x104}}, 0x0) executing program 3: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x7e, &(0x7f0000000140)={@local, @random, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010101, @local}, @time_exceeded={0x4, 0x0, 0x0, 0x3, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @broadcast=0xac14140a, @broadcast=0xac1414bb, {[@timestamp_addr={0x44, 0x34, 0x0, 0x1, 0x5, [{@local}, {@loopback, 0xe0000000}, {@local}, {@dev, 0xfffffffe}, {@dev}, {@broadcast}]}, @cipso={0x86, 0xa, 0x0, [{0x0, 0x2}, {0x0, 0x2}]}]}}}}}}}, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a34000000020a010800000000000000000a0000080900010073797a31000000000c000240000000000000000c080005400200000014000000110001009b45934ef2182b1dcf70c6f0a44e58773374fd0bc8f40ac1c1d52c543b6968fdd59395a32a"], 0x5c}, 0x1, 0x0, 0x0, 0x40080a5}, 0x20008040) executing program 3: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2, 0x2, 0x1) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x80000000, 0x0, 'queue0\x00', 0x32a}) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x80000000, 0x0, 'queue0\x00', 0x32a}) write$sndseq(r3, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f0000000440)={0x6, 0x20000006, 0x0, 0x0, 0xd}) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) (async) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) close_range(r2, 0xffffffffffffffff, 0x400000000000000) r4 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) (async) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) close(0x3) ioctl$F2FS_IOC_GET_PIN_FILE(r4, 0x8004f50e, &(0x7f00000000c0)) (async) ioctl$F2FS_IOC_GET_PIN_FILE(r4, 0x8004f50e, &(0x7f00000000c0)) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) (async) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_genetlink_get_family_id$team(&(0x7f0000000080), r1) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000040)={r6, 0x1, 0x6, @multicast}, 0x10) (async) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000040)={r6, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000000)={r6, 0x1, 0x6, @multicast}, 0x10) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000280)={'ip6tnl0\x00', &(0x7f0000000200)={'ip6tnl0\x00', 0x0, 0x29, 0x2, 0x20, 0x5, 0x2, @local, @rand_addr=' \x01\x00', 0x1, 0x7, 0x8236, 0x1}}) getpeername$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000380)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000480)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl2\x00', 0x0, 0x27, 0x3, 0x7, 0x81, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, 0x20, 0x20, 0xffff, 0x4}}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000004c0)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000004c0)) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=@newqdisc={0x50, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x1}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x3}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}]}, 0x50}}, 0x10) syz_clone3(&(0x7f0000000480)={0x3200000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, &(0x7f0000000440)=[0xffffffffffffffff], 0x1}, 0x58) munlockall() (async) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) executing program 4: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0x4, 0x8, 0xfe, 0xfffffffe, 0x80000000, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x7, 0x9, 0xffff2d37, 0xff, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xfeffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c70, 0x80000000, 0x242, 0x8, 0xe, 0x4, 0x80008071, 0xffffb8f3, 0x17, 0x6, 0x7, 0x5, 0x3e, 0x8f, 0x8, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x4, 0x4, 0x0, 0xfffffffa], [0x1000, 0x9, 0x8000012f, 0x8004, 0x5, 0x5, 0x129432e7, 0x46, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x0, 0x7, 0xc2bf, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c7, 0xd, 0x4de, 0x0, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x389, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c9368d, 0x80, 0x3], [0x4, 0xc08, 0x4, 0x5, 0xfffffffd, 0xd, 0x31b, 0x9, 0x5, 0x7fff, 0x9, 0x6, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xe, 0x5, 0x0, 0x2, 0xda6, 0xc, 0x4, 0x6d01, 0x2, 0x38, 0x800003, 0x200, 0x80, 0x7, 0x4, 0x2950bfb1, 0x1000, 0x400000a2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x9, 0x3, 0x0, 0x10000, 0x104, 0x37f3, 0xffff, 0xa622, 0x1, 0x5, 0x1, 0xffffffff, 0x14f, 0x4, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x4, 0x4, 0x4c7, 0x1, 0xfffff000, 0x7, 0x5, 0x7e, 0x100, 0x3173, 0x40000047, 0xb2, 0x8, 0x6, 0x10, 0x5, 0x5, 0x8, 0x30b1d693, 0x4008a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0x0, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd) executing program 0: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000007000000040000000700000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000010000000000000000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0200000001"], 0x48) executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r0, 0x80000) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000028c0)={'wlan0\x00', &(0x7f0000000100)=@ethtool_gstrings={0x1b, 0x1}}) executing program 0: r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371cfffe0069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="200000000a0a010100000000000000000a0000090900010073797a3180004000"], 0x20}, 0x1, 0x0, 0x0, 0x24048014}, 0x4000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') close(0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x24c01, 0x0) write$FUSE_NOTIFY_RESEND(r3, &(0x7f00000000c0)={0x14}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xe, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc6, &(0x7f0000000180)=""/198, 0x0, 0x1, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r3}, 0x94) preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/46, 0x2e}, {&(0x7f00000000c0)=""/62, 0x3e}], 0x2, 0x8, 0x9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'syz_tun\x00', 0x2000}) executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000010000304000000000000000000000020", @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000240)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) (async) bind$tipc(r1, &(0x7f0000000240)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) socket$tipc(0x1e, 0x2, 0x0) (async) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000540)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x0, 0x4}}, 0x10, 0x0}, 0x10) name_to_handle_at(r0, &(0x7f0000000140)='./mnt\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x400) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2000000000d2a0040000000000000000010000030900010073797a30000000002c000000010001010000000000000000010000000900010073797a30000000000900030073797a14000000004c0000fc060a010400000000000000000100000808000b400000000024000480200001800d00010073796e70726f7879000000000c00028008000340000000042b00010073797a30000000001400000011000100000000000800000000000000"], 0xc0}}, 0x4000) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2000000000d2a0040000000000000000010000030900010073797a30000000002c000000010001010000000000000000010000000900010073797a30000000000900030073797a14000000004c0000fc060a010400000000000000000100000808000b400000000024000480200001800d00010073796e70726f7879000000000c00028008000340000000042b00010073797a30000000001400000011000100000000000800000000000000"], 0xc0}}, 0x4000) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFC_CMD_SE_IO(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008f50540000000020900020073797a310000000008000a"], 0xb0}, 0x1, 0x0, 0x0, 0x14}, 0x40) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010000003000000000000000000000010", @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800b0001006272696467650000100002800c0021"], 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00420076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) executing program 1: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000080)="360fc3330f2172f2f775c9f00fb3050fc7b50000b8de000f00d80f48e5660f3a4154520064660ff63ef2b2660fea4e03", 0x30}], 0x1, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, &(0x7f0000000080)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) lsm_get_self_attr(0x67, &(0x7f0000000000)={0x0, 0x0, 0x7f, 0x5f, ""/95}, &(0x7f00000000c0)=0x7f, 0x1) (async) lsm_get_self_attr(0x67, &(0x7f0000000000)={0x0, 0x0, 0x7f, 0x5f, ""/95}, &(0x7f00000000c0)=0x7f, 0x1) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10) (async) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) clock_nanosleep(0xb, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x0) (async) clock_nanosleep(0xb, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='cdg', 0x3) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe3", 0x10d, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='nv', 0x2) (async) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='nv', 0x2) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a010800000000000000000700ffff0900010073797a300000000040000000030a01040000000000110000070000000900010073797a30000000000900030073797a300000000014000480080001400000000008000240ffffff3864000000060a01040000000000000000070000000900010073797a30000000000900020073797a30000000003800048034000180090001006d65746100000000240002800800014000000001080002400000001108"], 0xec}}, 0x0) executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4400000010000104000000000000000000000015", @ANYRES32=0x0, @ANYBLOB="8a450200000000002400128009000100626f6e6400000000140002800500010006000000080002"], 0x44}}, 0x40) executing program 1: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000580)="e4995c8f12f32ed7d3313b", &(0x7f0000000600)="34bea38afb"}}, &(0x7f0000000140)=0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x77359400}}, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL-gettid-timer_create-openat$vhost_vsock-timer_settime-mkdirat detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000580)="e4995c8f12f32ed7d3313b", &(0x7f0000000600)="34bea38afb"}}, &(0x7f0000000140)=0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x77359400}}, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) program crashed: KASAN: slab-use-after-free Read in dvb_device_open single: successfully extracted reproducer found reproducer with 29 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL-gettid-timer_create-openat$vhost_vsock-timer_settime detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000580)="e4995c8f12f32ed7d3313b", &(0x7f0000000600)="34bea38afb"}}, &(0x7f0000000140)=0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x77359400}}, 0x0) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL-gettid-timer_create-openat$vhost_vsock detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000580)="e4995c8f12f32ed7d3313b", &(0x7f0000000600)="34bea38afb"}}, &(0x7f0000000140)) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL-gettid-timer_create detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000580)="e4995c8f12f32ed7d3313b", &(0x7f0000000600)="34bea38afb"}}, &(0x7f0000000140)) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL-gettid detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) gettid() program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY-ioctl$vim2m_VIDIOC_S_CTRL detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r6, 0x3305) writev(r6, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r4, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r7, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000f00)={0xf0f003, 0x5}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$WPAN_SECURITY detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) writev(r5, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r2, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) getsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f0000000380), &(0x7f0000000540)=0x4) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp-ioctl$sock_SIOCGIFINDEX_80211 detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) writev(r5, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r2, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) writev(r5, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r2, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-ptrace$getregset detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) writev(r5, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) ptrace$getregset(0x4205, r2, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) writev(r5, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-writev-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) writev(r5, &(0x7f0000000180)=[{&(0x7f00000000c0)='8', 0x1}], 0x1) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$SNAPSHOT_FREE-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNAPSHOT_FREE(r5, 0x3305) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-openat$binder_debug-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-ioctl$CDROM_SET_OPTIONS-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) ioctl$CDROM_SET_OPTIONS(r4, 0x5320, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$cdrom-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000480), 0xa002, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-ioctl$VIDIOC_REQBUFS-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000500)={0x9, 0xc, 0x0, 0x0, 0xfe}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-openat$vicodec0-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-writev-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="d3", 0x63}], 0x1) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-syz_clone-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-memfd_create-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) ptrace(0x10, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-ioctl$SNDCTL_SEQ_CTRLRATE-syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000400)=0x10009) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-openat$sequencer-syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_open_dev$vim2m-syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) syz_open_dev$vim2m(&(0x7f0000000440), 0x2000000f5, 0x2) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-getsockopt$EBT_SO_GET_INFO-syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = socket$inet(0x2, 0x4, 0x1) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x15, 0x5, 0x9, 0xf, 0x7, 0x5]}, &(0x7f0000000100)=0x78) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: socket$inet(0x2, 0x4, 0x1) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(0x0, 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000280)={0x0, 0x3cc4e46c0762fa4b, 0x2}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ptrace-syz_open_dev$dvb_frontend-openat$snapshot-ioctl$VIDIOC_REQBUFS-syz_init_net_socket$bt_hidp detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x701101, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true reproducing took 50m35.891606096s repro crashed as (corrupted=false): ===================================================== ================================================================== BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Read of size 8 at addr ffff88802db9e618 by task syz.0.3023/15191 CPU: 0 UID: 0 PID: 15191 Comm: syz.0.3023 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4a4675e98e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffc780c6e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555589ead500 RCX: 00007f4a4675e98e RDX: 0000000000000002 RSI: 00007ffc780c6ef0 RDI: ffffffffffffff9c RBP: 00007ffc780c6ef0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f4a46a25fac R14: 00007f4a46a25fa0 R15: 00007f4a46a25fa0 Allocated by task 1: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x552/0x820 drivers/media/dvb-core/dvb_frontend.c:3074 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline] vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510 platform_probe+0x106/0x1d0 drivers/base/platform.c:1507 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602 do_one_initcall+0x11c/0x6f0 init/main.c:1362 do_initcall_level init/main.c:1424 [inline] do_initcalls init/main.c:1440 [inline] do_basic_setup init/main.c:1460 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1675 kernel_init+0x21/0x1e0 init/main.c:1565 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 15189: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6508 [inline] kfree+0x22b/0x6d0 mm/slub.c:6801 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629 dvb_device_put drivers/media/dvb-core/dvbdev.c:628 [inline] dvb_device_open+0x2ba/0x3b0 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802db9e600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 24 bytes inside of freed 256-byte region [ffff88802db9e600, ffff88802db9e700) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2db9e head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 7347894220 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7417 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] bus_add_driver+0x92/0x5b0 drivers/base/bus.c:747 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_register_driver drivers/usb/core/driver.c:1082 [inline] usb_register_driver+0x21c/0x3e0 drivers/usb/core/driver.c:1064 do_one_initcall+0x11c/0x6f0 init/main.c:1362 do_initcall_level init/main.c:1424 [inline] do_initcalls init/main.c:1440 [inline] do_basic_setup init/main.c:1460 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1675 kernel_init+0x21/0x1e0 init/main.c:1565 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff88802db9e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802db9e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802db9e600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802db9e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802db9e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ===================================================== ================================================================== BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Read of size 8 at addr ffff88802db9e618 by task syz.0.3023/15191 CPU: 0 UID: 0 PID: 15191 Comm: syz.0.3023 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4a4675e98e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffc780c6e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555589ead500 RCX: 00007f4a4675e98e RDX: 0000000000000002 RSI: 00007ffc780c6ef0 RDI: ffffffffffffff9c RBP: 00007ffc780c6ef0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f4a46a25fac R14: 00007f4a46a25fa0 R15: 00007f4a46a25fa0 Allocated by task 1: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x552/0x820 drivers/media/dvb-core/dvb_frontend.c:3074 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline] vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510 platform_probe+0x106/0x1d0 drivers/base/platform.c:1507 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602 do_one_initcall+0x11c/0x6f0 init/main.c:1362 do_initcall_level init/main.c:1424 [inline] do_initcalls init/main.c:1440 [inline] do_basic_setup init/main.c:1460 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1675 kernel_init+0x21/0x1e0 init/main.c:1565 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 15189: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6508 [inline] kfree+0x22b/0x6d0 mm/slub.c:6801 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629 dvb_device_put drivers/media/dvb-core/dvbdev.c:628 [inline] dvb_device_open+0x2ba/0x3b0 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802db9e600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 24 bytes inside of freed 256-byte region [ffff88802db9e600, ffff88802db9e700) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2db9e head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 7347894220 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7417 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] bus_add_driver+0x92/0x5b0 drivers/base/bus.c:747 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_register_driver drivers/usb/core/driver.c:1082 [inline] usb_register_driver+0x21c/0x3e0 drivers/usb/core/driver.c:1064 do_one_initcall+0x11c/0x6f0 init/main.c:1362 do_initcall_level init/main.c:1424 [inline] do_initcalls init/main.c:1440 [inline] do_basic_setup init/main.c:1460 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1675 kernel_init+0x21/0x1e0 init/main.c:1565 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff88802db9e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802db9e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802db9e600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802db9e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802db9e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================