./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2454664728

<...>
Warning: Permanently added '10.128.1.135' (ED25519) to the list of known hosts.
execve("./syz-executor2454664728", ["./syz-executor2454664728"], 0x7fffe6a0dc00 /* 10 vars */) = 0
brk(NULL)                               = 0x5555757a3000
brk(0x5555757a3d00)                     = 0x5555757a3d00
arch_prctl(ARCH_SET_FS, 0x5555757a3380) = 0
set_tid_address(0x5555757a3650)         = 5854
set_robust_list(0x5555757a3660, 24)     = 0
rseq(0x5555757a3ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2454664728", 4096) = 28
getrandom("\x0f\x96\x21\x72\xb9\xdd\x00\xbd", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555757a3d00
brk(0x5555757c4d00)                     = 0x5555757c4d00
brk(0x5555757c5000)                     = 0x5555757c5000
mprotect(0x7f8b966d3000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
executing program
write(1, "executing program\n", 18)     = 18
openat(AT_FDCWD, "/dev/comedi4", O_WRONLY|O_SYNC|O_CLOEXEC) = 3
epoll_create(3)                         = 4
epoll_ctl(4, EPOLL_CTL_ADD, 3, {events=EPOLLHUP|EPOLLET, data={u32=0, u64=0}}) = 0
ioctl(3, COMEDI_DEVCONFIG, 0)           = 0
exit_group(0)                           = ?
[   88.110733][ T5854] ==================================================================
[   88.118826][ T5854] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0
[   88.126995][ T5854] Read of size 1 at addr ffff88802f3dfcb0 by task syz-executor245/5854
[   88.135238][ T5854] 
[   88.137578][ T5854] CPU: 1 UID: 0 PID: 5854 Comm: syz-executor245 Not tainted 6.16.0-rc5-next-20250709-syzkaller #0 PREEMPT(full) 
[   88.137597][ T5854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[   88.137614][ T5854] Call Trace:
[   88.137621][ T5854]  <TASK>
[   88.137627][ T5854]  dump_stack_lvl+0x189/0x250
[   88.137651][ T5854]  ? rcu_is_watching+0x15/0xb0
[   88.137675][ T5854]  ? __kasan_check_byte+0x12/0x40
[   88.137690][ T5854]  ? __pfx_dump_stack_lvl+0x10/0x10
[   88.137711][ T5854]  ? rcu_is_watching+0x15/0xb0
[   88.137730][ T5854]  ? lock_release+0x4b/0x3e0
[   88.137749][ T5854]  ? __virt_addr_valid+0x1c8/0x5c0
[   88.137773][ T5854]  ? __virt_addr_valid+0x4a5/0x5c0
[   88.137796][ T5854]  print_report+0xca/0x230
[   88.137811][ T5854]  ? _raw_spin_lock_irqsave+0xa7/0xf0
[   88.137827][ T5854]  kasan_report+0x118/0x150
[   88.137841][ T5854]  ? _raw_spin_lock_irqsave+0xa7/0xf0
[   88.137860][ T5854]  ? remove_wait_queue+0x24/0x120
[   88.137874][ T5854]  __kasan_check_byte+0x2a/0x40
[   88.137887][ T5854]  lock_acquire+0x8d/0x360
[   88.137909][ T5854]  _raw_spin_lock_irqsave+0xa7/0xf0
[   88.137925][ T5854]  ? remove_wait_queue+0x24/0x120
[   88.137939][ T5854]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[   88.137958][ T5854]  ? ep_unregister_pollwait+0x7b/0x240
[   88.137976][ T5854]  remove_wait_queue+0x24/0x120
[   88.137989][ T5854]  ? ep_unregister_pollwait+0x147/0x240
[   88.138007][ T5854]  ? ep_unregister_pollwait+0x7b/0x240
[   88.138023][ T5854]  ep_unregister_pollwait+0x153/0x240
[   88.138042][ T5854]  ep_clear_and_put+0xed/0x3a0
[   88.138059][ T5854]  ? __pfx_ep_eventpoll_release+0x10/0x10
[   88.138077][ T5854]  ep_eventpoll_release+0x45/0x60
[   88.138098][ T5854]  __fput+0x44c/0xa70
[   88.138142][ T5854]  task_work_run+0x1d1/0x260
[   88.138160][ T5854]  ? __pfx_task_work_run+0x10/0x10
[   88.138180][ T5854]  do_exit+0x6b5/0x2300
[   88.138198][ T5854]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   88.138224][ T5854]  ? __pfx_do_exit+0x10/0x10
[   88.138241][ T5854]  ? _raw_spin_unlock_irq+0x23/0x50
[   88.138257][ T5854]  ? lockdep_hardirqs_on+0x9c/0x150
[   88.138278][ T5854]  do_group_exit+0x21c/0x2d0
[   88.138295][ T5854]  __x64_sys_exit_group+0x3f/0x40
[   88.138309][ T5854]  x64_sys_call+0x21f7/0x2200
[   88.138324][ T5854]  do_syscall_64+0xfa/0x3b0
[   88.138345][ T5854]  ? lockdep_hardirqs_on+0x9c/0x150
[   88.138364][ T5854]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   88.138379][ T5854]  ? clear_bhb_loop+0x60/0xb0
[   88.138397][ T5854]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   88.138412][ T5854] RIP: 0033:0x7f8b9665ecb9
[   88.138430][ T5854] Code: Unable to access opcode bytes at 0x7f8b9665ec8f.
[   88.138438][ T5854] RSP: 002b:00007ffcbd1d63c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   88.138455][ T5854] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8b9665ecb9
[   88.138466][ T5854] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   88.138475][ T5854] RBP: 00007f8b966d9290 R08: ffffffffffffffb8 R09: 00007ffcbd1d65e8
[   88.138487][ T5854] R10: 00007ffcbd1d65e8 R11: 0000000000000246 R12: 00007f8b966d9290
[   88.138497][ T5854] R13: 0000000000000000 R14: 00007f8b966d9ce0 R15: 00007f8b96630ab0
[   88.138514][ T5854]  </TASK>
[   88.138519][ T5854] 
[   88.441435][ T5854] Allocated by task 1:
[   88.445499][ T5854]  kasan_save_track+0x3e/0x80
[   88.450198][ T5854]  __kasan_kmalloc+0x93/0xb0
[   88.454795][ T5854]  __kmalloc_cache_noprof+0x230/0x3d0
[   88.460178][ T5854]  comedi_device_postconfig+0x4a8/0xc90
[   88.465735][ T5854]  comedi_auto_config+0x267/0x380
[   88.470759][ T5854]  comedi_test_init+0x8e/0x110
[   88.475524][ T5854]  do_one_initcall+0x233/0x820
[   88.480296][ T5854]  do_initcall_level+0x137/0x1f0
[   88.485239][ T5854]  do_initcalls+0x69/0xd0
[   88.489659][ T5854]  kernel_init_freeable+0x3d9/0x590
[   88.494858][ T5854]  kernel_init+0x1d/0x1d0
[   88.499192][ T5854]  ret_from_fork+0x3fc/0x770
[   88.503786][ T5854]  ret_from_fork_asm+0x1a/0x30
[   88.508545][ T5854] 
[   88.510868][ T5854] Freed by task 5854:
[   88.514841][ T5854]  kasan_save_track+0x3e/0x80
[   88.519556][ T5854]  kasan_save_free_info+0x46/0x50
[   88.524583][ T5854]  __kasan_slab_free+0x62/0x70
[   88.529352][ T5854]  kfree+0x18e/0x440
[   88.533255][ T5854]  comedi_device_detach+0x372/0x720
[   88.538452][ T5854]  comedi_unlocked_ioctl+0xc4b/0xf40
[   88.543747][ T5854]  __se_sys_ioctl+0xf9/0x170
[   88.548346][ T5854]  do_syscall_64+0xfa/0x3b0
[   88.552854][ T5854]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   88.558754][ T5854] 
[   88.561076][ T5854] The buggy address belongs to the object at ffff88802f3dfc00
[   88.561076][ T5854]  which belongs to the cache kmalloc-256 of size 256
[   88.575126][ T5854] The buggy address is located 176 bytes inside of
[   88.575126][ T5854]  freed 256-byte region [ffff88802f3dfc00, ffff88802f3dfd00)
[   88.588924][ T5854] 
[   88.591252][ T5854] The buggy address belongs to the physical page:
[   88.597674][ T5854] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f3de
[   88.606437][ T5854] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   88.614933][ T5854] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   88.622480][ T5854] page_type: f5(slab)
[   88.626463][ T5854] raw: 00fff00000000040 ffff88801a841b40 dead000000000122 0000000000000000
[   88.635045][ T5854] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   88.643628][ T5854] head: 00fff00000000040 ffff88801a841b40 dead000000000122 0000000000000000
[   88.652294][ T5854] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   88.660964][ T5854] head: 00fff00000000001 ffffea0000bcf781 00000000ffffffff 00000000ffffffff
[   88.669655][ T5854] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   88.678323][ T5854] page dumped because: kasan: bad access detected
[   88.684745][ T5854] page_owner tracks the page as allocated
[   88.690462][ T5854] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 23961708630, free_ts 0
[   88.710434][ T5854]  post_alloc_hook+0x240/0x2a0
[   88.715204][ T5854]  get_page_from_freelist+0x21e4/0x22c0
[   88.720765][ T5854]  __alloc_frozen_pages_noprof+0x181/0x370
[   88.726573][ T5854]  alloc_pages_mpol+0x232/0x4a0
[   88.731422][ T5854]  allocate_slab+0x8a/0x370
[   88.735926][ T5854]  ___slab_alloc+0xbeb/0x1410
[   88.740620][ T5854]  __kmalloc_cache_noprof+0x296/0x3d0
[   88.746003][ T5854]  bus_add_driver+0x162/0x640
[   88.750691][ T5854]  driver_register+0x23a/0x320
[   88.755457][ T5854]  __hid_register_driver+0x12a/0x170
[   88.760746][ T5854]  do_one_initcall+0x233/0x820
[   88.765521][ T5854]  do_initcall_level+0x137/0x1f0
[   88.770465][ T5854]  do_initcalls+0x69/0xd0
[   88.774798][ T5854]  kernel_init_freeable+0x3d9/0x590
[   88.780000][ T5854]  kernel_init+0x1d/0x1d0
[   88.784335][ T5854]  ret_from_fork+0x3fc/0x770
[   88.788926][ T5854] page_owner free stack trace missing
[   88.794305][ T5854] 
[   88.796626][ T5854] Memory state around the buggy address:
[   88.802250][ T5854]  ffff88802f3dfb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   88.810321][ T5854]  ffff88802f3dfc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   88.818377][ T5854] >ffff88802f3dfc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   88.826441][ T5854]                                      ^
[   88.832066][ T5854]  ffff88802f3dfd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   88.840138][ T5854]  ffff88802f3dfd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   88.848216][ T5854] ==================================================================
[   88.856293][ T5854] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   88.863515][ T5854] CPU: 1 UID: 0 PID: 5854 Comm: syz-executor245 Not tainted 6.16.0-rc5-next-20250709-syzkaller #0 PREEMPT(full) 
[   88.875417][ T5854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[   88.885491][ T5854] Call Trace:
[   88.888781][ T5854]  <TASK>
[   88.891717][ T5854]  dump_stack_lvl+0x99/0x250
[   88.896321][ T5854]  ? __asan_memcpy+0x40/0x70
[   88.900925][ T5854]  ? __pfx_dump_stack_lvl+0x10/0x10
[   88.906150][ T5854]  ? __pfx__printk+0x10/0x10
[   88.910752][ T5854]  panic+0x2e2/0x7b0
[   88.914656][ T5854]  ? __pfx_panic+0x10/0x10
[   88.919078][ T5854]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   88.924980][ T5854]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   88.931320][ T5854]  ? print_memory_metadata+0x314/0x400
[   88.936793][ T5854]  ? _raw_spin_lock_irqsave+0xa7/0xf0
[   88.942179][ T5854]  check_panic_on_warn+0x89/0xb0
[   88.947118][ T5854]  ? _raw_spin_lock_irqsave+0xa7/0xf0
[   88.952492][ T5854]  end_report+0x78/0x160
[   88.956738][ T5854]  kasan_report+0x129/0x150
[   88.961247][ T5854]  ? _raw_spin_lock_irqsave+0xa7/0xf0
[   88.966625][ T5854]  ? remove_wait_queue+0x24/0x120
[   88.971671][ T5854]  __kasan_check_byte+0x2a/0x40
[   88.976528][ T5854]  lock_acquire+0x8d/0x360
[   88.980959][ T5854]  _raw_spin_lock_irqsave+0xa7/0xf0
[   88.986171][ T5854]  ? remove_wait_queue+0x24/0x120
[   88.991197][ T5854]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[   88.997101][ T5854]  ? ep_unregister_pollwait+0x7b/0x240
[   89.002561][ T5854]  remove_wait_queue+0x24/0x120
[   89.007421][ T5854]  ? ep_unregister_pollwait+0x147/0x240
[   89.013001][ T5854]  ? ep_unregister_pollwait+0x7b/0x240
[   89.018459][ T5854]  ep_unregister_pollwait+0x153/0x240
[   89.023841][ T5854]  ep_clear_and_put+0xed/0x3a0
[   89.028611][ T5854]  ? __pfx_ep_eventpoll_release+0x10/0x10
[   89.034336][ T5854]  ep_eventpoll_release+0x45/0x60
[   89.039379][ T5854]  __fput+0x44c/0xa70
[   89.043370][ T5854]  task_work_run+0x1d1/0x260
[   89.047966][ T5854]  ? __pfx_task_work_run+0x10/0x10
[   89.053091][ T5854]  do_exit+0x6b5/0x2300
[   89.057271][ T5854]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   89.062654][ T5854]  ? __pfx_do_exit+0x10/0x10
[   89.067248][ T5854]  ? _raw_spin_unlock_irq+0x23/0x50
[   89.072447][ T5854]  ? lockdep_hardirqs_on+0x9c/0x150
[   89.077644][ T5854]  do_group_exit+0x21c/0x2d0
[   89.082240][ T5854]  __x64_sys_exit_group+0x3f/0x40
[   89.087271][ T5854]  x64_sys_call+0x21f7/0x2200
[   89.091958][ T5854]  do_syscall_64+0xfa/0x3b0
[   89.096498][ T5854]  ? lockdep_hardirqs_on+0x9c/0x150
[   89.101703][ T5854]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   89.107772][ T5854]  ? clear_bhb_loop+0x60/0xb0
[   89.112474][ T5854]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   89.118372][ T5854] RIP: 0033:0x7f8b9665ecb9
[   89.122786][ T5854] Code: Unable to access opcode bytes at 0x7f8b9665ec8f.
[   89.129798][ T5854] RSP: 002b:00007ffcbd1d63c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   89.138219][ T5854] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8b9665ecb9
[   89.146194][ T5854] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   89.154171][ T5854] RBP: 00007f8b966d9290 R08: ffffffffffffffb8 R09: 00007ffcbd1d65e8
[   89.162156][ T5854] R10: 00007ffcbd1d65e8 R11: 0000000000000246 R12: 00007f8b966d9290
[   89.170130][ T5854] R13: 0000000000000000 R14: 00007f8b966d9ce0 R15: 00007f8b96630ab0
[   89.178110][ T5854]  </TASK>
[   89.181387][ T5854] Kernel Offset: disabled
[   89.185721][ T5854] Rebooting in 86400 seconds..