Extracting prog: 56m13.23020903s
Minimizing prog: 10m33.862788559s
Simplifying prog options: 0s
Extracting C: 1m46.053971708s
Simplifying C: 22m3.950234248s


extracting reproducer from 37 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "407327c360"}]}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "1c"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x90}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysfs-fsetxattr$security_capability-fgetxattr
detailed listing:
executing program 0:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/warn_count', 0x20000, 0xbe)
fsetxattr$security_capability(r0, &(0x7f0000000000), 0x0, 0x45, 0x1)
fgetxattr(r0, &(0x7f0000000000)=ANY=[], 0x0, 0x8)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-recvmmsg
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0)
recvmmsg(r0, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000001c0)=""/143, 0x8f}, {&(0x7f0000002800)=""/236, 0xec}, {&(0x7f0000000180)=""/62, 0x3e}, {&(0x7f0000001640)=""/4083, 0xff3}], 0x4}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000003900)=""/4090, 0xffa}, {&(0x7f0000002900)=""/4096, 0x1000}, {&(0x7f0000002640)=""/203, 0xcb}, {&(0x7f0000000280)=""/102, 0x66}], 0x4}, 0x900000}], 0x7, 0x22, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0x801, 0x41, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38)
bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-ioctl$USBDEVFS_SUBMITURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-ioctl$USBDEVFS_SUBMITURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})

program did not crash
single: failed to extract reproducer
bisect: bisecting 37 programs with base timeout 30s
testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 0:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@getstat={0xe0, 0x15, 0x1, 0x70bd28, 0x25dfdbfd, {{'cryptd(ecb-aes-neon)\x00'}, '\x00', '\x00', 0x2000, 0x2000}}, 0xe0}, 0x1, 0x0, 0x0, 0xc000}, 0x20040000)
executing program 0:
r0 = syz_io_uring_setup(0xf2d, &(0x7f0000000180)={0x0, 0xb5d2, 0x8, 0x1, 0x33a}, &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000300))
io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f00000003c0)={0x1, 0x1, 0x0, &(0x7f0000000340)=[{0x0}], 0x0}, 0x20)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000600)={0x2, 0x0, [{0x486, 0x0, 0x4417}, {0x95c, 0x0, 0x7}]})
executing program 0:
setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000580)="22cfe8e2590da815133b8674ef79adbcb05e76f7d0ece20eb79b63944d4bc7421d2b1ccf9054b7b38b8682f2e32ba2dd00", 0x31, 0x1)
getxattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)=@known='user.incfs.metadata\x00', &(0x7f0000000100)=""/109, 0x6d)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="700000001000ffff25bd6100fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7a0a050023080000500012800b000100697036746e6c00004000028008000100", @ANYRES32, @ANYBLOB="140003002001000000000000000000000000000114000200fe88"], 0x70}, 0x1, 0x0, 0x0, 0x4000080}, 0x4008000)
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
executing program 32:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0)
sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x8000)
executing program 5:
r0 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]})
ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff})
executing program 3:
r0 = syz_clone(0x20042400, 0x0, 0xfffffffffffffc3b, 0x0, 0x0, 0x0)
ptrace(0x4206, r0)
ptrace(0x4207, r0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])
executing program 2:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil)
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xca}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mq_unlink(&(0x7f0000000000)='eth0\x00')
executing program 1:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4})
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x2001)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0)
sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x14, r1, 0x301, 0xffffffff, 0x25dfdbfc, {0x2f}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0)
executing program 4:
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80})
ioctl$UFFDIO_REGISTER(r0, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x7}, {0xffff, 0x5, 0x1, 0x46, 0x6, 0xfd}]})
write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250)
executing program 2:
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106)
recvmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002340)=""/41, 0x29}, 0x7fd}], 0x1, 0x40002002, 0x0)
executing program 4:
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100fdffffff0010000006000000080009000200000008000b"], 0x24}, 0x1, 0x0, 0x0, 0x24000001}, 0x890)
executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38)
bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2, 0x6e}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xf9)
executing program 4:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r0, 0x3ba0, &(0x7f00000000c0)={0x48, 0xb, r1})
executing program 1:
r0 = socket(0xa, 0x3, 0x87)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'dummy0\x00', <r1=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@loopback, 0x7a, r1})
executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_snmp6\x00')
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xfb)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0x801, 0x41, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0)
recvmmsg(r0, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000001c0)=""/143, 0x8f}, {&(0x7f0000002800)=""/236, 0xec}, {&(0x7f0000000180)=""/62, 0x3e}, {&(0x7f0000001640)=""/4083, 0xff3}], 0x4}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000003900)=""/4090, 0xffa}, {&(0x7f0000002900)=""/4096, 0x1000}, {&(0x7f0000002640)=""/203, 0xcb}, {&(0x7f0000000280)=""/102, 0x66}], 0x4}, 0x900000}], 0x7, 0x22, 0x0)
executing program 5:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/warn_count', 0x20000, 0xbe)
fsetxattr$security_capability(r0, &(0x7f0000000000), 0x0, 0x45, 0x1)
fgetxattr(r0, &(0x7f0000000000)=ANY=[], 0x0, 0x8)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "407327c360"}]}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "1c"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x90}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: bisecting 37 programs
bisect: split chunks (needed=false): <37>
bisect: split chunk #0 of len 37 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])
executing program 2:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil)
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xca}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mq_unlink(&(0x7f0000000000)='eth0\x00')
executing program 1:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4})
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x2001)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0)
sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x14, r1, 0x301, 0xffffffff, 0x25dfdbfc, {0x2f}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0)
executing program 4:
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80})
ioctl$UFFDIO_REGISTER(r0, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x7}, {0xffff, 0x5, 0x1, 0x46, 0x6, 0xfd}]})
write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250)
executing program 2:
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106)
recvmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002340)=""/41, 0x29}, 0x7fd}], 0x1, 0x40002002, 0x0)
executing program 4:
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100fdffffff0010000006000000080009000200000008000b"], 0x24}, 0x1, 0x0, 0x0, 0x24000001}, 0x890)
executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38)
bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2, 0x6e}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xf9)
executing program 4:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r0, 0x3ba0, &(0x7f00000000c0)={0x48, 0xb, r1})
executing program 1:
r0 = socket(0xa, 0x3, 0x87)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'dummy0\x00', <r1=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@loopback, 0x7a, r1})
executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_snmp6\x00')
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xfb)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0x801, 0x41, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0)
recvmmsg(r0, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000001c0)=""/143, 0x8f}, {&(0x7f0000002800)=""/236, 0xec}, {&(0x7f0000000180)=""/62, 0x3e}, {&(0x7f0000001640)=""/4083, 0xff3}], 0x4}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000003900)=""/4090, 0xffa}, {&(0x7f0000002900)=""/4096, 0x1000}, {&(0x7f0000002640)=""/203, 0xcb}, {&(0x7f0000000280)=""/102, 0x66}], 0x4}, 0x900000}], 0x7, 0x22, 0x0)
executing program 5:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/warn_count', 0x20000, 0xbe)
fsetxattr$security_capability(r0, &(0x7f0000000000), 0x0, 0x45, 0x1)
fgetxattr(r0, &(0x7f0000000000)=ANY=[], 0x0, 0x8)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "407327c360"}]}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "1c"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x90}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 0:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@getstat={0xe0, 0x15, 0x1, 0x70bd28, 0x25dfdbfd, {{'cryptd(ecb-aes-neon)\x00'}, '\x00', '\x00', 0x2000, 0x2000}}, 0xe0}, 0x1, 0x0, 0x0, 0xc000}, 0x20040000)
executing program 0:
r0 = syz_io_uring_setup(0xf2d, &(0x7f0000000180)={0x0, 0xb5d2, 0x8, 0x1, 0x33a}, &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000300))
io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f00000003c0)={0x1, 0x1, 0x0, &(0x7f0000000340)=[{0x0}], 0x0}, 0x20)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000600)={0x2, 0x0, [{0x486, 0x0, 0x4417}, {0x95c, 0x0, 0x7}]})
executing program 0:
setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000580)="22cfe8e2590da815133b8674ef79adbcb05e76f7d0ece20eb79b63944d4bc7421d2b1ccf9054b7b38b8682f2e32ba2dd00", 0x31, 0x1)
getxattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)=@known='user.incfs.metadata\x00', &(0x7f0000000100)=""/109, 0x6d)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="700000001000ffff25bd6100fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7a0a050023080000500012800b000100697036746e6c00004000028008000100", @ANYRES32, @ANYBLOB="140003002001000000000000000000000000000114000200fe88"], 0x70}, 0x1, 0x0, 0x0, 0x4000080}, 0x4008000)
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
executing program 32:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0)
sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x8000)
executing program 5:
r0 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]})
ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff})
executing program 3:
r0 = syz_clone(0x20042400, 0x0, 0xfffffffffffffc3b, 0x0, 0x0, 0x0)
ptrace(0x4206, r0)
ptrace(0x4207, r0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 2:
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106)
recvmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002340)=""/41, 0x29}, 0x7fd}], 0x1, 0x40002002, 0x0)
executing program 4:
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100fdffffff0010000006000000080009000200000008000b"], 0x24}, 0x1, 0x0, 0x0, 0x24000001}, 0x890)
executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38)
bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2, 0x6e}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xf9)
executing program 4:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r0, 0x3ba0, &(0x7f00000000c0)={0x48, 0xb, r1})
executing program 1:
r0 = socket(0xa, 0x3, 0x87)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'dummy0\x00', <r1=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@loopback, 0x7a, r1})
executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_snmp6\x00')
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xfb)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0x801, 0x41, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0)
recvmmsg(r0, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000001c0)=""/143, 0x8f}, {&(0x7f0000002800)=""/236, 0xec}, {&(0x7f0000000180)=""/62, 0x3e}, {&(0x7f0000001640)=""/4083, 0xff3}], 0x4}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000003900)=""/4090, 0xffa}, {&(0x7f0000002900)=""/4096, 0x1000}, {&(0x7f0000002640)=""/203, 0xcb}, {&(0x7f0000000280)=""/102, 0x66}], 0x4}, 0x900000}], 0x7, 0x22, 0x0)
executing program 5:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/warn_count', 0x20000, 0xbe)
fsetxattr$security_capability(r0, &(0x7f0000000000), 0x0, 0x45, 0x1)
fgetxattr(r0, &(0x7f0000000000)=ANY=[], 0x0, 0x8)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "407327c360"}]}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "1c"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x90}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 0:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@getstat={0xe0, 0x15, 0x1, 0x70bd28, 0x25dfdbfd, {{'cryptd(ecb-aes-neon)\x00'}, '\x00', '\x00', 0x2000, 0x2000}}, 0xe0}, 0x1, 0x0, 0x0, 0xc000}, 0x20040000)
executing program 0:
r0 = syz_io_uring_setup(0xf2d, &(0x7f0000000180)={0x0, 0xb5d2, 0x8, 0x1, 0x33a}, &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000300))
io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f00000003c0)={0x1, 0x1, 0x0, &(0x7f0000000340)=[{0x0}], 0x0}, 0x20)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000600)={0x2, 0x0, [{0x486, 0x0, 0x4417}, {0x95c, 0x0, 0x7}]})
executing program 0:
setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000580)="22cfe8e2590da815133b8674ef79adbcb05e76f7d0ece20eb79b63944d4bc7421d2b1ccf9054b7b38b8682f2e32ba2dd00", 0x31, 0x1)
getxattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)=@known='user.incfs.metadata\x00', &(0x7f0000000100)=""/109, 0x6d)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="700000001000ffff25bd6100fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7a0a050023080000500012800b000100697036746e6c00004000028008000100", @ANYRES32, @ANYBLOB="140003002001000000000000000000000000000114000200fe88"], 0x70}, 0x1, 0x0, 0x0, 0x4000080}, 0x4008000)
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
executing program 32:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffffc, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0)
sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x8000)
executing program 5:
r0 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]})
ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff})
executing program 3:
r0 = syz_clone(0x20042400, 0x0, 0xfffffffffffffc3b, 0x0, 0x0, 0x0)
ptrace(0x4206, r0)
ptrace(0x4207, r0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])
executing program 2:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil)
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xca}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mq_unlink(&(0x7f0000000000)='eth0\x00')
executing program 1:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4})
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x2001)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0)
sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x14, r1, 0x301, 0xffffffff, 0x25dfdbfc, {0x2f}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0)
executing program 4:
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80})
ioctl$UFFDIO_REGISTER(r0, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x7}, {0xffff, 0x5, 0x1, 0x46, 0x6, 0xfd}]})
write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <13>, <13>
bisect: split chunk #0 of len 13 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0)
sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x8000)
executing program 5:
r0 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]})
ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff})
executing program 3:
r0 = syz_clone(0x20042400, 0x0, 0xfffffffffffffc3b, 0x0, 0x0, 0x0)
ptrace(0x4206, r0)
ptrace(0x4207, r0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])
executing program 2:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil)
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xca}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mq_unlink(&(0x7f0000000000)='eth0\x00')
executing program 1:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4})
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x2001)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0)
sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x14, r1, 0x301, 0xffffffff, 0x25dfdbfc, {0x2f}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0)
executing program 4:
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80})
ioctl$UFFDIO_REGISTER(r0, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x7}, {0xffff, 0x5, 0x1, 0x46, 0x6, 0xfd}]})
write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 13 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0)
sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x8000)
executing program 5:
r0 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]})
ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff})
executing program 3:
r0 = syz_clone(0x20042400, 0x0, 0xfffffffffffffc3b, 0x0, 0x0, 0x0)
ptrace(0x4206, r0)
ptrace(0x4207, r0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 2:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil)
executing program 4:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xca}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mq_unlink(&(0x7f0000000000)='eth0\x00')
executing program 1:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4})
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x2001)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0)
sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x14, r1, 0x301, 0xffffffff, 0x25dfdbfc, {0x2f}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0)
executing program 4:
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80})
ioctl$UFFDIO_REGISTER(r0, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x7}, {0xffff, 0x5, 0x1, 0x46, 0x6, 0xfd}]})
write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0)
sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x8000)
executing program 5:
r0 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]})
ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff})
executing program 3:
r0 = syz_clone(0x20042400, 0x0, 0xfffffffffffffc3b, 0x0, 0x0, 0x0)
ptrace(0x4206, r0)
ptrace(0x4207, r0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <6>, <7>
bisect: split chunk #0 of len 6 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 7 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)

program did not crash
bisect: split chunks (needed=true): <3>, <4>, <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147f40, 0x0)
preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0xffffffff, 0x1f)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8)
executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8}}]}}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00')
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #2 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 2:
io_setup(0x2, &(0x7f0000000000)=<r0=>0x0)
r1 = eventfd(0x800)
io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x842, r1, 0x0, 0x0, 0x34}, &(0x7f00000000c0)={0x0, 0x0, 0x8000000, 0x7, 0x3, r1, 0x0, 0x0, 0x7, 0x0, 0x1, r1}])

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3]
detailed listing:
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4093, 0xffd}, {&(0x7f00000006c0)=""/17, 0x11}], 0x2}, 0x6}], 0x1, 0x2202, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080)
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>, <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3]
detailed listing:
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3]
detailed listing:
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xfffff9bd, 0xfe00, 0x2, 0x8, 0x15, 0x6, 0x1a}, &(0x7f0000000000)=0x9c)
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3]
detailed listing:
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 3:
r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0)
close(0x3)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: split chunk #2 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3]
detailed listing:
executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 3 programs left: 

executing program 3:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f0000000000)={0x8, {"34cd41c8570778342e16a1f73a86206dd1122c51193e45d18b72c199d8f84b2f859b18c7951bed50adccadb653883449ec2a4662f59de35b881ac3630573038feaa031eac74b6500c56cc2fb125142426d79126649d8180c9d4a568e31a2cfe533e1754cd77f3f73c16c1839acec835f0a5158b2ef7302b99cfd5bc6a647ea755285f3e9394036166aee6a356546b23fc330ce576d57b877211decb920ef22f04dcb62707c25f141b5fa2fd945e9b367bc394109155dd16dc612962e79b2e48aa26536d656a33489ecabe9e10c7bee0d9aa7a7a216a4541ea4e01b66f61154d6452b81563e3d04712a36d5d755d7cd6226ed3d67ada9fa555888972b98f67831427ef29d79552d38b2addb8764b92b9650eaeade4a0d974e187ce15b340a7e23b3f4593ff84e881243fb1220c12a9e44694f80700b77f76e83bbe6f2d37684c4417d1e2672d46da4b2ea4b19034a10830a176586168bb93730ffaa3b14e9bc54723ad2a5c0c9f5b4acbfcbc2640021ebaa0b555afa6c70b12c9886c855dd19329836efe56aa10d0f81e74b72f2678bd616bda8eaee33c4f2804da99caa358de8955c3fd2a2c1dd02d9f7d5cb05e37cb08fed22b8f390a7604e52ae173bf0a1b1b4cd8dd2612273be6bc5ca4aa776011483f7d42bd1f56cfa61eadd8586215c1c71a72dbb6bf6537251216181ef2d1a23dab3eb6cb000a0079b565a2fb1b887911e33e6c38dc8d9424ae41c2f646a24fe2fa8f7301d336c20a3e0ae412bbce75d39b09c94deac766332023a2ff00c80f5b82f7dc6c030a31df51014777237a5f59525a60864e6c95eeaeed91041691ace5ef09e9c746429caf63103931d80d344514cdfbc8e8ebfe74ed1f6e4c235568e679f8bece4069b81276d58a3bbb02fa687c2d2eb75e7bd1e7eda4ed9518927055cde98e4824dfd9629454a50e5f5f6757748a86f365333895e4249bbeeec77fa61a8c289aabbce7b4d2f85076ed5c8b092053af938330368cc678b5a03be4fac020c807c4564dc0fbbc68b719192ec539977e00e6c070bd7e9cb2043cc3960204d40fe9a12246d74903edb8171111d68ee3c236892a2425501ca2fa019641f43cb5f3cfc205f369f54e01296e149f5c663657e4dd352bd58cc8dc1babc1aca8105e152b23932ca1a434d68304045e3c6203985bc03c5a1ce54cbe8694e3f9acbe3d28d53b15e3b22e681197106b99a5d4c508e17f2a29cdb78d1b9684d4816232f3b2a2aca26ddd7632f2c2bef40580a82c0de843b6c19de7d3a8d1ace5af499f60732de626c5540d964cd214fd54e69837a050bb9f0f1af81755e4e9bf678018ddccebefbef8a6388097e5da5ab41ea35344d8353a06f7a3a19f1ea088fc072bbe85f3466a9e43001522fe0381cf0e7e2f1f2ea1e53745ef707387dd81c6802114262ce4131f98b249267ca785921f57c8c12a05bf027466c6609e064edc1ad5610f516f8390390a7b0e26b90bb15d31058319e1f941da1651e2aba0de35d78bd37914f43404d1e42aa1348dc19363b29329cbea88ca51c3ca4cf585e5b68bd790ca636bca4cc3c24affa9a21d5d1b8feca951a1c8aa1860603b17edc2ab7c9064380ac4b5ec340bb2713e52434a650d3cbd009d740890fda9e5e1d386f35103a00869fb5de8a0eef91b10052734f8abf9c0f97c52cca3f2fb3740e8b6aa3ac5a21177a6fe3bae7e184097ccf6f3bc94e6d995c4dbad6d8347fee4093fc39a889c120328aee2197e893bcac9a383648358ed4d41c23c8620a4f2b816a60214cc67bd575381be99ea342581e72cf92df4bb9b2982274ba58ce6e4e55b6f054829d3f16bd5c2a6b7476f16d78b52d9e54b291092d49fba2cff8320ae529e06817df90d47703fca4d967f08fbc4cf937f7f09d46fe574e1736e962eedf813c3a847c27cdafe21601355b172640697bc457f99c7439d8ffface07534f13fe40189c183bc6b67a522af566199993c7d1f11a2f849154fe08b78fcd7de1d0ffee093ca25bcc5d43cf9f621b36564ac0bc8a6456acdfd9d7fa0040ec3e325d4cf0c1f6014fb0c148257bc725c7effde838091c0cbe33b99aec56c5e6926a05789764822a923a0861aadd81eb06bc6868465c9fa3cc9ed176ae8b068fd12c4f676d36417164a2c7d7717b56b8c9a5c7cb878f6529ca6a140191f314ebd01fbc1978ad87add843614ccbf301f7da89b6ebc2695ecca4a68d67db760776a0593c11c670d62e2ba322281343021ac74b09d27bf3ca775a9be1a06e68d9b5fc4839526c872f51da3cc8512c6639a231b7108fc828a0095d6d9c65f88b2e2b291a67eeb36c73db8fa17ee9bfdfcf141429f449d9e54a98f3901491d3a776254aae52c0d4d4954b27f93ae1c5bee9352adfdecee42696e1bf98712c9b2dfacbd8af63f1f6792e3193d18fd4711bd511a43dfcf3670d4c978756b473c701a67fefcd337e948368e04c7a5acd7f118a6b366635d6826fa50c3a6dd9667fe24db6fc40bcee07fb3b2ab2bb2f827700fe561990c95fff32630bb193553ce5fde5f96523c6de46f6722011abef1d7d60634fb41e8c5676c5685e860dc24f8d5fef3a9f634bd71d4d577f638d3a4a1476ae3dbed5e810e6e2939e9136f34ea97da324678ec7df47b30fb416fdde39bee0376b954702ecea8ffceaaaa8aa16a7e3568e24cff6274d24530c7ed35f09ddadb9cc7fdbac711cfd6815ab88d489cfe9c0372cf4bac9c1dce1ef725b80a44d20a1ae1c3b4c98bf2c23ac81115c28c046fa24baa706ab7ec63d98171aaf986c05a9be22d24cd72bcf7828ff9a25dee8705ceeaebc78c3a9e15f768dee6f4e068ed3979a1e52c5d3938c1f701af83c9d7f004017688cb3e0be1200d897b0a805e2fe830d470078796c51e7098c932a82b7ed3d8976dcba20f533b2bc73dc7ab7ad22ade9620cfee863033153cb46db734346f5b9ba9724baf8effb998e6f6d2d0e4bf6f608cb9133bcf0241e3404e8d61b057f6a0e3d55472754f840580d65caff356dc92f5a4e6eadddda1f2afe6f2dd3cb078b51617b9a723cd52e0bf5760aa8db3118dabab890abf0f8b20c3b3a80e5245925bced72e1f22b94b9ceb0e7ccd203888236c635bd8b543b8b53fcef0c27d59df7568db920ee7dfde94a62898efae82cdbcb37ced41ed09a05b37fa8239a30d2d98ac1ff449eab08ca7d84e4beb7857018a20652a9f4795306a27f43f57db31e45eddf279a68deb419aafcbdfa87b52b1ff63770da76a0d1994ac44cd500add6337039f7f1a89ee4b99860054558c8927b866943c76c8dba0970e6a37c5e2d117b1ce0a182504350acad98c6ecfdae7c5cef9019945f042a6872f4ee507ac54736b3f7d38c6ee7a3e04eb77be9d4721f0f346e3c87ab33058b9695f362aff99a908f0ea045e1cdef860e477ccf9023802618a8d74002d1c2e2f05f82d5f9e37b9463b2d806e82b5485ed5750b12e23e32e0dcdd4547591bccaad1c596470f66b1649150ee9cc3f6a39698cbbd043926ae5f94278481dd927a693610a6ce5880dfbd1f284f3272a4f6e65bd5d55dc67b0ad85fbddfcadb456909f0753cd7eeeb264d26cc82e8ae3ebaf8746cd63962bcf5992869e53bd1560c576d2bd04f4ab6fd225a15337170eb8ec48e231517ebfd0a97f4864c66ad19d7fde774875a247774ff349132527e31ba878beed3150f5c730cee1b3340e70b36ba4ea3645ed3dc6e5e8a371d8a660ddc1181afad04efed28f372b7040de56f02f73793a32d612fb96ecee8e32ba5df07867104ca0855de2fc9d8ef603481221bbcceabac01686dc3bbe3c62d030fe6a50515e899120efda8360f4e595f60d4a8889d62d6bb6ad8df26c6314fca86dd215d812e6599addc09a709784bbc7a65e9438d9ba8e9b4b1ebc4775dcea84f207339c0a6bb34817a0e8b68a8330e31fdd5baaa03e427a368c6d9bf8ddd028416e254087d325d10671e82a082a5383c66e3eab7752f439342226e74ba68dd1bbfeaa28ff61b7ed20863a09f476d308b2146c6cf006cc8150985a6a7f8c0371729b1b03c23500fb125f195546f2079e7aeabd28bcb46ae56e3bb510f57b1b13c2895e6762e4bdfb185cbc1c597de77878f9288664effa7e253143c82e1d19dec20f899078bf93fb688d810030b5fbc07566605f0a8dabce96d9ffdd3e10474798bece5393d7b76e92e2ccccd8d1c2d55a66dc4540ae035668268d7a3481547c99ed994004c002ded6bdc160a8eabf2faef868aacb749652356e4fa911dc6589b62c6ddcb4a84bb11c7136641eb6dfbb47d4f88f1edf6596c3ac039a8e906c5b37a5cab3fa516c655e659a3a6f4d5261e50c1b429aec441c3c1cbafd38f2f693edffd8cb66479587a31a1c685f94c366f862920b326c4740fa1b572c8ee79dfe5721792ac946e33332fe1e56487b3ab8c8023b22578fb3eead7632861e757deb8a2a7203f6204a96b5c8cd3bae483930748800302466d8686aea825ed19195f63164420ab7b66eb94fceb08b2df587ea7c41ed00d8ee61da72b781cb1455dcdedb1edf1f4c3cdda096c7a7e090721fb7fb0462b98ad9c4f53578cb6f3db07723b31c7ff73f10fc0129f75eb9eb755fab6dc960127b379614d96caab0efdba51d1f276078f76cf9f435320bde9f152577aa71f9579675bed18e582f73c7efe6dd2697265618b0005570470cf880248779a6c02ea1e166081af250d1fe4e6cf6bf33fae52e29f38622dcd78d5281f4b99df28237b186f5e3e0a55f6191454918b66d2cfe9c77e6b45ee1e3d2e1b0becbbddbb3cb19680bc119c09f9a173418a47c26ed43c2f67c60ba6096a13ab071f8445ac9d5e956ea597eb9dbaf19e23c19f52f1fb0ff92dc54f9eea4f476d4a599480b9dd033118438bf52aa392f183166fa869745b036d8e9733a8c0dc7be1bf357c998469cd3b7224cdc4bd79d5cac86e241596bc59d47d4dc51f29425ed2529ef1ddba3e4e73a8f21326cc08cd7045422baf759d9d10e32ffa15b6dda65ea9b1b8480866b06a23b90cd340f4aefe75dbe3579c58d2f4ee351b45b24074489c4414403dd66051c06687cfec14179d4a121663f013361e344ded7b4b179e80e9ba4b89ca5b1a2bf46bb912c06002fe77d70ca5f5eec59d1a6ff52dcc380482505608a66bb1d7cdd7c770ae57d60721c1a0362a667c56ad4701f7e5bd90964867a8988422fddae3a999dd71a93da2ca705e64332953c30eb72fd99d5440eada6a21257c12be36bd91c4f1546d1835d72a4f06984c79a7af4b76abd710081ab52e92ffcc1ba9c3feac797ea6c122c3c3c077d813b9c3cbd1e4dd714aa8786e596ddfa6b428a902b76af3ec7d35166b6821b5a545fe65a9a55f4def0e3f8ee815feed064a8f832c832e9a5b72227812f42c8763964a0d2a8e343d1587515a0bd0e9f58c298fe4f66f34319c97fca61b8bbad785ec3fa1d76011e3060dab7acb6d9800eeac7517c6bf8f81e4b8165a0558e2cbbcb19149d1e9cb47bed9c0a20b4545e27e1c4b7f46118a33558824f8a6f2e032cf8b1bcd4cd7c32edbe17ddfe85f995c0c39147482c72ee6370505928755a46ad846e7058d1355d7575646d15cfe644f7687be31b3113cc185cfa678a58c65c103e555ea2ca1f38fd32e7288141292f7fa4359e2fa53b0d7809578835994fce0f1c4084b019a0a4272d8ca7c39d358061475724f227169d06b3c4c36ac2ff8b0c191c411d6c806f9de3bc4a260c4fcb26f82593f7ded21447882913101fe8597468a9582e0ab2a62331c5eae500", 0x1000}}, 0x101e)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)


bisect: trying to concatenate
bisect: concatenate 3 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 3, 3]
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
dup(r0)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3, 3]
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x1)
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 3]
detailed listing:
executing program 0:
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
minimized 3 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 3]
detailed listing:
executing program 3:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 3]
detailed listing:
executing program 3:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 3]
detailed listing:
executing program 3:
executing program 0:
syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 2:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
cachestat(r0, &(0x7f0000000240)={0x100000000, 0x81}, &(0x7f0000000440), 0x0)

program did not crash
minimized 3 calls -> 3 calls
minimizing program #2 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 2]
detailed listing:
executing program 3:
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 1]
detailed listing:
executing program 3:
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1)

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 0]
detailed listing:
executing program 3:
executing program 5:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])
executing program 0:

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
minimized 3 calls -> 0 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB])

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"])

program crashed: KASAN: slab-use-after-free Read in tasklet_action_common
validation run: crashed=true
reproducing took 1h35m9.918852076s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 kernel/softirq.c:954
Read of size 8 at addr ffff888035947158 by task syz-executor/5756

CPU: 0 UID: 0 PID: 5756 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 tasklet_action_common+0x103/0x490 kernel/softirq.c:954
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 tun_flow_delete_by_queue drivers/net/tun.c:379 [inline]
 __tun_detach+0xccc/0x1900 drivers/net/tun.c:614
 tun_detach drivers/net/tun.c:653 [inline]
 tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3587
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x73a/0x2360 kernel/exit.c:986
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1129
 __do_sys_exit_group kernel/exit.c:1140 [inline]
 __se_sys_exit_group kernel/exit.c:1138 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1138
 x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f558db9e159
Code: Unable to access opcode bytes at 0x7f558db9e12f.
RSP: 002b:00007ffc01d96c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f558dc35fb3 RCX: 00007f558db9e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 00007f558dc35fc5 R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 00000000000927c0 R14: 0000000000015771 R15: 00007ffc01d96e10
 </TASK>

Allocated by task 9:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ath9k_init_wmi+0x4f/0x2b0 drivers/net/wireless/ath/ath9k/wmi.c:95
 ath9k_htc_probe_device+0x1e5/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:956
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 9:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6801
 ath9k_htc_probe_device+0x11a9/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:978
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888035947000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 344 bytes inside of
 freed 2048-byte region [ffff888035947000, ffff888035947800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35940
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1225, tgid 1225 (kworker/0:2), ts 87487181723
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545
 kmalloc_reserve net/core/skbuff.c:637 [inline]
 __alloc_skb+0x2c1/0x7a0 net/core/skbuff.c:715
 alloc_skb include/linux/skbuff.h:1384 [inline]
 mld_newpack+0x165/0xcb0 net/ipv6/mcast.c:1810
 add_grhead net/ipv6/mcast.c:1921 [inline]
 add_grec+0x119f/0x19d0 net/ipv6/mcast.c:2060
 mld_send_initial_cr+0x288/0x550 net/ipv6/mcast.c:2305
 mld_dad_work+0x3d/0x480 net/ipv6/mcast.c:2331
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
page last free pid 5650 tgid 5650 ts 85122206691 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x9eb/0xaf0 mm/page_alloc.c:1463
 __free_contig_range_common+0x174/0x340 mm/page_alloc.c:7072
 __free_contig_range mm/page_alloc.c:7117 [inline]
 free_pages_bulk+0x48/0x120 mm/page_alloc.c:5322
 vm_area_free_pages mm/vmalloc.c:3461 [inline]
 vfree+0x231/0x490 mm/vmalloc.c:3510
 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3414
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff888035947000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888035947080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888035947100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888035947180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888035947200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 kernel/softirq.c:954
Read of size 8 at addr ffff888035947158 by task syz-executor/5756

CPU: 0 UID: 0 PID: 5756 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 tasklet_action_common+0x103/0x490 kernel/softirq.c:954
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 tun_flow_delete_by_queue drivers/net/tun.c:379 [inline]
 __tun_detach+0xccc/0x1900 drivers/net/tun.c:614
 tun_detach drivers/net/tun.c:653 [inline]
 tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3587
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x73a/0x2360 kernel/exit.c:986
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1129
 __do_sys_exit_group kernel/exit.c:1140 [inline]
 __se_sys_exit_group kernel/exit.c:1138 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1138
 x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f558db9e159
Code: Unable to access opcode bytes at 0x7f558db9e12f.
RSP: 002b:00007ffc01d96c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f558dc35fb3 RCX: 00007f558db9e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 00007f558dc35fc5 R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 00000000000927c0 R14: 0000000000015771 R15: 00007ffc01d96e10
 </TASK>

Allocated by task 9:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ath9k_init_wmi+0x4f/0x2b0 drivers/net/wireless/ath/ath9k/wmi.c:95
 ath9k_htc_probe_device+0x1e5/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:956
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 9:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6801
 ath9k_htc_probe_device+0x11a9/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:978
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888035947000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 344 bytes inside of
 freed 2048-byte region [ffff888035947000, ffff888035947800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35940
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1225, tgid 1225 (kworker/0:2), ts 87487181723
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545
 kmalloc_reserve net/core/skbuff.c:637 [inline]
 __alloc_skb+0x2c1/0x7a0 net/core/skbuff.c:715
 alloc_skb include/linux/skbuff.h:1384 [inline]
 mld_newpack+0x165/0xcb0 net/ipv6/mcast.c:1810
 add_grhead net/ipv6/mcast.c:1921 [inline]
 add_grec+0x119f/0x19d0 net/ipv6/mcast.c:2060
 mld_send_initial_cr+0x288/0x550 net/ipv6/mcast.c:2305
 mld_dad_work+0x3d/0x480 net/ipv6/mcast.c:2331
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
page last free pid 5650 tgid 5650 ts 85122206691 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x9eb/0xaf0 mm/page_alloc.c:1463
 __free_contig_range_common+0x174/0x340 mm/page_alloc.c:7072
 __free_contig_range mm/page_alloc.c:7117 [inline]
 free_pages_bulk+0x48/0x120 mm/page_alloc.c:5322
 vm_area_free_pages mm/vmalloc.c:3461 [inline]
 vfree+0x231/0x490 mm/vmalloc.c:3510
 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3414
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff888035947000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888035947080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888035947100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888035947180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888035947200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================